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Subject SS-2020-O CYT-01-R SIT.r 

Nyikx' I Ins agreement and all of its atiaclinients shall become public upon submission to (inventor and 
Executive CouiK.il fcjr approval. Any inlormalion that is private. coulltleuiialorproprieiarv must 
| clearly identified to the agency and agreed to in writing prior to signing the contract. 

AGREEMENT 

The State of New I lampshire and the Contractor hereby mutually agree as follow a- 

general provisions 


I. IDENTIFICATION. 


1.1 State Agency Name 

Ml Department of Health ami Human Services 

1.2 State Agency Address 

129 Pleasant Street 

Concord, Nl 1 03301-3857 

1..' Contractor Name 

ITkcrd Vmiih Alternatives. Inc. 

1.5 Contractor Photic 

Number 

7 27-<16|-2990 

kVa l-ckcrd Connects 

1 A Contractor Address 

100 N. Si arc rest Drive, Clearwater. 1 1. *3^65 

1.6 Account Number 

05-095-IM 2 J I21010*29600000 

1.' Completion Date 1.8 Price l.imhalion 

June 30.2021 S216.000 

! 

1.9 Contracting Officer for State Agency 

Nathan 1). White, Director 

1.10 Stale Agency Telephone Number 

603-271-9631 

III Contractor Signature 

L12 Name and \ itlc of Con tract or Signaior) 

David Dennis, President 

I.Ij Acknowledgement: State of Florae* .County of PlOCtlC|$~ - 

On May 30, 2019 , before the undersigned officer, personally appeared the person identified in block 1 J 2. or satisfactorily 

proven to be the person whose name is signed in block 111, and acknowledged that s/he executed this document in the capacity * 
indicated in block 1.12, 

U 3.1 Signature of Notary Public or Justice ol the Peace ^v**s^£* UNDSEYl'ANt 

tpsxtosu-i c*5lom> m* sscss 

j^ c;i || TMi ButJgrtHatJiy SfMcil 

1J 3.2 Name and Title or Notary or Justice of the Peace 

undNtM uune NWaru 


1 Id Stale Agency Signature 

Date; 

1.15 Name and 'Title of Stale Agency Signatory' 

U 6 Approval by the Nil. Department of Administration, Division of Personnel (if applicable/ 

Director, On: 

117 Approval by the Attorney General (lorm, Substance and Execution) (ifapplkabl,e> 

%•' On: 

1.18 Approval by the Governor and Executive Council (if applicable/ 

P>: On: 
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2. EM FLO YM ENT OF COVER A CTOR/SER VICKS TO 
BE PERFORMED. The Stale of New Hampshire, acting 
through the agency identified in block U (“Stale”). engages 
contractor identified in block 1.3 (“Contractor 1 ') to perform, 
and the Contractor shall perform, the work or sale of goods, or 
both, identified and more particularly described in the attached 
I XIJimi'A winch is incorporated herein Ji) reference 
(‘Services''). 

3. EFFECTIVE DATE/COM PLKTION Ol SERVICES. 

3.1 Notwithstanding any provision of this Agreement to the 
contrary, and subject to the approval of the Governor attd 
Executive Council of the Stale of New Hampshire, if 
applicable, this Agreement, and all obligations of the parties 
hereunder, shall become effective on the date the Governor 
and Executive Council approve this Agreement as indicated in 
block 1.18. unless no such approval is required. In which case 
the Agreement shall become effective on the dale the 
Agreement is signed by the Slate Agency as shown in block 

I M (“Effective Date’ 1 ). 

3.2 If the i on tractor commences the Services prior to the 
Directive Dale, alt Services performed by the Contractor prior 
to the Effective Date shall be performed at the sole risk of the 
Contractor, and in the event that this Agreement docs not 
become effective, the Stale shall have no liability to the 
Contractor, including without limitation, any obligation to pay 
the Contractor for any costs incurred or Services performed. 
Contractor must complete all Sen ices by the Completion Date 
specified in block 1.7. 

4. CONDITIONAL NATURE OF AGREEMENT. 
Notwithstanding any provision of tit is Agreement to the 
contrary- all obligations of the Stale hereunder, including, 
without limitation, the coni inuance of payments hereunder, are 
contingent upon the availability and continued appropriation 
of funds, and in no event shall the State be liable Tor any 
payments hereunder in excess of such available appropriated 
funds. In the event of a reduction or termination of 
appropriated funds, the State shall have the right to withhold 
payment until such funds become available, if ever, and shall 
have the right to terminate this Agreement immediately upon 
giving the Contractor notice of such termination. The Stale 
shall not he required to transfer funds from any other account 
to the Account identified in block 1.6 in the event funds in that 
Account arc reduced or unavailable, 

5. CONTRACT PRICK/PRICK LIMITATION/ 

PAYMENT. 

5.1 flie contract price, met hod of payment, and terms of 
payment arc identified and more particularly described in 
l"Xl IIHI f B which is incorporated herein by reference. 

5.2 I he payment by the Stale or the contract price shall be the 
only and the complete reimbursement to the Contractor for all 
expenses, of whatever nature incurred by the Contractor in the 
performance hereof, and shall be the only and the complete 
compensation to the Contractor for the Services. The State 
shall have no liability to the Contractor other than the contract 
price 


5.3 I he State reserves the right to olfsei from an\ amounts 
otherwise payable to the C on tractor under this Agreement 
tlio.se liquidated amounts required or permitted by VI I. RSA 
80*7 through RSA 80:7-c or any oilier provision of law. 

5.4 Notwithstanding un\ provision m this Agreement to the 
contrary, and notwithstanding unexpected circumstances, in 
no event shall the total of all pa\ incuts authorised, or actually 
made hereunder, exceed the Price 1.imitation set forth in block 
1 - 8 . 

fi. COMPLIANCE BY CONTRACTOR WITH LAWS 
AND REGULATIONS/ EQUAL EMPLOYMENT 
OPPORTUNITY. 

6.1 In connection with the performance of the Services, the 
Contractor shall comply with all statutes, law s, regulations, 
and orders of federal, stale, county or municipal authorities 
which impose any obligation or duty upon the Contractor, 
including, but not limited to, civil rights and equal opportunity 
laws. T his may include the requirement to utilize auxiliarv 
aids and services to ensure that persons with communication 
disabilities, including vision, hearing and speech, can 
communicate with, receive information from, and convey 
information to the Contractor In addition, the Contractor 
shall comply with all applicable copy right laws. 

6.2 During the term of this Agreement, the Contractor shall 
not discriminate against employees or applicants for 
employment because of race, color, religion, creed, age, sex, 
handicap, sexual orientation, or national origin and w ill lake 
alfirinaiivc action to prevent such discrimination. 

6.3 If this Agreement is funded in any pari by monies of the 
United States, the Contractor shall comply with all the 
provisions of Executive Older No. 11246 (‘‘Equal 
Employment Opportunity”), as supplemented by the 
regulations of the United Stales Department of Labor (4 I 
CT.R. Part 60), and with any rules, regulations and guidelines 
as the State of New Hampshire or the United States issue to 
implement these regulations. The Contractor further agrees to 
permit the State or United States access to any of the 
Contractor’s books, records and accounts for the purpose of 
ascertaining compliance with all rules, regulations and orders, 
and the covenants, terms and conditions of this Agreement. 

7. PERSONNEL, 

7.1 The Contractor shall at its own expense provide all 
personnel necessary to perform the Services. The Contractor 
warrants that all personnel engaged in the Services shall be 
qualified to perform the Services, and shall be properly 
licensed and otherwise authorized to do so under all applicable 
laws. 

7.2 Unless otherw ise authorized in writing, during the term of 
this Agreement* and for a period of six (6) months a Her the 
Completion Date in block 1.7, the Contractor shall not hire, 
and shall not permit any subcontractor or other person, firm or 
corporation with whom it is engaged tn a combined effort to 
perform the Services to hire* any person who is a State 
employee or official, who is materially involved in the 
procurement, administration or performance of this 



Dale now 
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Agreement. I his provision shall survive termination of this 
Agreement. 

".3 The Contracting Officer specified in block 1,9. or his or 
her successor, shall be the Slate's represent at ive. In the event 
of any dispute concerning the imerpretalion of this Agreement, 
the Contracting Officer s decision shall be final for the Slate 


8 EVEN I Ob 1)1 EA l I DR EM EDIKS. 

8.1 Any one or more of the following acts or omissions of the 
Contractor shall constitute an event of default hereunder 
(‘‘Event of Default'’); 

8.11 failure to perform the Services satisfactorily or on 
schedule; 

8.1.2 failure to submit any report required hereunder; anchor 
8 J .3 failure to perforin any other covenant, term or condition 
of this Agreement. 

8.2 l pnn the occurrence of any I* vent of Default, the Stale 
may take any one. or more, or all. of the following actions; 

8.2.1 give tlie Contractor a written notice specifying the Invent 
of Default and requiring it to be remedied within, in the 
absence of a greater or lesser specification of time* thirty (30) 
days from the date of the notice; and if the Event of Default is 
not limeh remedied, term inale this Agreement, effective two 
(2) days after giving the Contractor notice of termination: 

8 2.2 give the Contractor a written notice specifying the IA cm 
of Default and suspending all payments to be made under this 
Agreement and ordering that the portion of the contract price 
which wottld otherwise accrue to the Contractor during the 
period from the date of such notice until such time as the Stale 
determines that the Contractor lias cured the Event of Default 
shall never be paid to the Contractor: 

8.2.3 set olTagainst any other obligations the Stale may owe to 
the Contractor any damages the Stale suffers by reason of any 
Event ofDefault; and/or 

8.2.4 treat (lie Agreement as breached and pursue any of its 
remedies at law or in equity, or both. 

9. DAI'A/ACCKSS/CONKIDKNTIALITV/ 
IMtKSERVATION. 


111. I I* JOHN A 11 ON. In the event id an early terminal ion of 
this Agreement for any reason other than the completion of the 
Services, the Contractor shall deliver n> the Contracting 
Officer, tint later limn fifteen f!5) days after the date of 
termination, a report (‘ Termination Report' ) describing in 
detail all Services performed, and the contract price carnal, to 
and including the date of termination. The form, subject 
matter, content, and number of copies of the l enninalion 
Report shall be identical to those of any final Report 
described in the attached I XINHIJ A. 

11. CONTRACTOR’S RELATION TO THE STATE. In 
the pcrlormance oft his Agreement the Contractor is in all 
respects an independent contractor, and is neither an agent nor 
an employee of the State. Neither the Contractor nor any of its 
officers, employees, agents or members shall have authority in 
hind the Stale or receive any benefits, workers* compensation 
or oilier emoluments provided l>v the State to its employees. 

12. ASSICLVM ENT/I)KEECATION/SL'BCONTILACTS. 

I he Contractor shall not assign, or otherwise transfer any 
interest in this Agreement without the prior written notice and 
consent of the Stale None of the Services shall be 
subcontracted by the Contractor without the prior written 
notice and consent of the State. 

13. INDEMNIFICATION, flic Contractor shall defend, 
indemnify and hold harmless the Stale, its officers and 
employees, from and against any and all losses suffered by the 
Slate, its officers and employees, and any and all claims, 
liabilities or penalties asserted against the State, its officers 
and employees, by or on behalf of any person, on account of, 
based or resulting from, arising out of (or which may be 
claimed to arise out of) the acts or omissions of the 
Contractor. Notwithstanding the foregoing, nothing herein 
contained shall be deemed to constitute a waiver of the 
sovereign immunity of the Stale, which immunity is hereby 
reserved to the Stale. This covenant in paragraph 13 shall 
survive the term inalion of this Agreement. 


9.1 As used in this Agreement, the wortl “data” shall mean all 
information and things developed or obtained during the 
performance of, or acquired or developed by reason of, this 
Agreement, including, but not limited to, all studies, reports, 
files, formulae, surveys, maps, charts, sound recordings, video 
recordings, pictorial reproductions, drawings, analyses, 
graphic representations, computer programs, computer 
printouts, notes, letters, memoranda, papers, and documents, 
all whether finished or unfinished. 


M. INSURANCE. 

14.1 I he Contractor shall, al its sole expense, obtain amt 
maintain in force, and shall require any subcontractor or 
assignee in obtain and maintain in force, the following 
insurance: 

14.1.1 comprehensive general liability insurance against all 
claims ofhudily injury, death or property damage, in amounts 
of not less than SEOOO,OOOper occurrence and $2,000,000 
aggregate; and 


9.2 All data and any property which has been received from 
the State or purchased with funds provided for that purpose 
under this Agreement, shall be the properly of the State, and 
shall be returned to the Slate upon demand or upon 
termination of this Agreement for any reason. 

9.3 Confident in lily of data shall be governed by VII. RSA 
chapter 91-A or oilier existing law. Disclosure of data 
requires prior written approval of the Slate. 


14.1.2 special cause of loss coverage form covering all 
properly subject to subparagraph 9.2 herein, in an amount not 
less than 80% of the whole replacement value of the property. 

14.2 I he policies described in subparagraph 14.1 herein shall 
be on policy forms and endorsements approved for use in the 
State of New I lampslure hv the VII. Department of 
Insurance, and issued by insurers licensed in the Stale of New 
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14.3 1 he Contractor shall furnish to flw i oniracting Officer 
idemificd in Nock 1.9. or Ins or her successor, a certificated 
of insurance for all insurance required under this Agreement. 
Contractor skill also furnish to (he Contracting Officer 
identified in block 1.9, or his or her successor, ceriificalc(s) of 
insurance for all renewals) of insurance required under this 
Vgreenieni no later than thirty (30) days prior to the expiration 
date of each of the insurance policies. I he certificate^ i of 
insurance and any renewals thereof shall be attached and arc 
incorporated herein by reference. Each certificated of 
insurance shall contain a clause requiring the insurer to 
provide the Contracting Officer identified in block 1.9, or his 
or her successor, no less than thirty (30} days prioa written 
notice of cancellation or modification of the policy. 

15. WORKERS* COMPENSATION, 
f 5.1 By signing this agreement, the Contractor agrees, 
certifies and warrants that the Contractor is in compliance u ith 
or exempt from, the requirements of VI I. KSA chapter 2S1-V 
i Workers Compensation ‘ \t, 

C 4 ) 2 To the extent the Contractor is subject to the 
requirements ofN.II. KSA chapter 281-A, Contractor shall 
maintain, and require any subcontractor or assignee to secure 
and maintain, payment of Workers' Compensation in 
connection with activities which the person proposes to 
undertake pursuant to this Agreement. Contractor shall 
furnish the Contracting Officer identified in block 1.9, or his 
or her successor, proof of Workers' Compensation in the 
manner described in VI I, KSA chapter 281 - A and any 
applicable renevval(s) thereof, which shall he attached and are 
incorporated herein by reference The Slate shall not be 
responsible for payment of any Workers 1 Compensation 
premiums or for any other claim or benefit for Contractor, or 
any subcontractor nr employee of Contractor, which might 
arise under applicable Stale of New 1 lainpshire Workers' 
Compensation laws in connection with the performance of the 
Services under this Agreement. 

Itf. WAIVER OF BREACH. No failure by the Stale to 
enforce any provisions hereof after any Event of Default shall 
be deemed a waiver of its rights with regard to that Event of 
Default, or any subsequent Event of Default, No express 
failure to enforce any Event of Default shall be deemed a 
waiver of the right of the Slate to enforce each and all of the 
provisions hereof upon any further or other Event of Default 
on the part of the Contractor. 


such approval js required under the circumstances pursuant to 
Slate lavs, rule or policy 

19. CONSTRUCTION OF AGREEMENT AND TERMS. 

I his Agreement shall be construed in accordance with the 
laws of the Slate of New I lainpshire, and is binding upon and 
inures to the benefit of the panies and their respect i\e 
successors and assigns. I he wording used in this Agreement 
is the wording chosen In the parlies to express their mutual 
intent, and no rule of construction shall be applied against or 
in fav or of any party. 

20. THIRD PARTIES. Hie parties hereto do not intend to 
benefit any third parties and this Agreement shall not be 
construed to confer any such benefit 

21. HEADINGS. The headings throughout the Agreement 
are for reference purposes only, and the words contained 
therein shall in no way he held to explain, modify, amplify or 
aid in the inicrprciaiion. construction or meaning of the 
provisions of this Agreement 

22. SPEC!AC PROVISIONS. Additional provisions set 
forth in the attached I.XIIIDI I C are incorporated herein by 
reference. 

23. SEVER A HIM IV. In the event any of the provisions of 
ibis Agreement are held by a court of competent jurisdiction to 
be contrary to an\ state or federal law, the remaining 
provisions of this Agreement will remain in full force and 
effect, 

24. ENTIRE AGREEMENT. I his Agreement, which may 
be executed in a number of counterparts, each of which shall 
be deemed an original, constitutes the entire Agreement and 
understanding between the parties, anil supersedes all prior 
Agreements and understandings relating hereto 


1 7 . NOTICE. Any notice by a parly hereto to the other parly 
shall be deemed to have been duly delivered or given at the 
time of mailing by certified mail, postage prepaid, in a United 
States Post Office addressed to the panics at the addresses 
given in blocks 1.2 and 1.4, herein. 

18. AMENDMENT. 1 his Agreement may be amended, 
waived or discharged only by an instrument in writing signed 
bv the panies hereto ami onl> a Her approval of such 
amendment, waiver or discharge by the Governor and 
Executive Council of the Stale of New Hampshire unless no 

Cuntraclor Initials ^ J »C 

Date 5 ■:«) }*> 
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Now Hampshire Department of Health and Human Services 
Eckerd Youth Alternatives, Inc. d/b/a Eckerd Kids 

Exhibit A 



Scope of Services 

1. Provisions Applicable to All Services 

11 The Contractor agrees that, to the extent future legislative action by the New Hampshire 
General Court or federal or state court orders may have an impact on the Services 
described herein, the Slate Agency has the right to modify Service priorities and 
expenditure requirements under this Agreement so as to achieve compliance therewith 

1.2 Notwithstanding any other provision of the Contract to the contrary no services shall 
continue after June 30. 2021, and the Department shall not be liable for any payments 
for services provided after June 30, 2021. unless and until an appropriation for these 
services has been received from the slate legislature and funds encumbered for the 
SFY 2020-2021 biennia. 

1 3 For the purposes of this Agreement, the Department has identified Eckerd Youth 
Alternatives, Inc as a Contractor, in accordance with 2 CFR 200 0 et seq 

1 4 This Agreement terminates and supersedes the Memorandum of Agreement approved 

by the Governor and Executive Council on June 7. 2017. Item #118 through the 
Department s contract with Casey Family Programs, Inc. 

2. Definitions 

2 1 Department means the New Hampshire Department of Health and Human Services. 

Division for Children, Youth and Families i DCYF ) 

2 2 Contractor means Eckerd Youth Alternatives Inc d/b/a Eckerd Kids a Florida 
nonprofit corporation. 

2.3. Subcontractor means Mindshare Consulting Group LLC, a Florida not-for-profit 
organization that the Contractor subcontracts with under this Agreement 

2 4 Confidential Information means the definition in Exhibit K, which is attached hereto 
and incorporated by reference herein. 

2 5. Eckerd Rapid Safety Feedback® means a program developed by Eckerd Kids that 
utilizes predictive analytics to help identify child welfare cases of the highest 
probability of a serious injury or death and identifying critical case practices, that when 
performed by the Department to applicable standards, will greatly assist in keeping 
the child safe. The Rapid Safety Feedback® model is dependent upon proprietary 
web-based software called Mindshare and the Contractor subcontracts with 
Mindshare to provide this service. 

2.6 Eckerd Rapid Safety Feedback® Community of Practice means the Department 

participating in quarterly fidelity review and sharing information and reports with the 
Contractor. 

2.7. Fidelity Review means a review by the Contractor and its subcontractor, to ensure 
the Department is implementing Eckerd Rapid Safety Feedback® according to 
established practices. 

2.8. CCWIS/SACWIS means the Department's statewide automated child welfare 
information system, including data extract for district offices. 


Eckerd Youth Alternatives Inc Exhibit A Contractor Initials 

d/b/a Eckerd Kids 
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New Hampshire Department of Health and Human Services 
Eckerd Youth Alternatives, Inc. d/b/a Eckerd Kids 

Exhibit A 



2 9 Web Portal means a website and related technology that is designed to read 
CCWIS/SACWIS information, perform automated analysis, and generate reports for 
use to implement and support Eckerd Rapid Safety Feedback® 

2 10 Portal Terms means the website usage terms available on the Portal that sets forth 
the terms and conditions under which the Department may use the Portal 

2 11 QA Staff means Department Quality Assurance staff member who does not carry a 

caseload 

3. Scope of Services 

3.1 The Contractor utilizing its subcontract with proprietary software entity Mmdshare shall 
host maintain and support a dedicated, secure Web Portal with a goal of providing the 
Department with twenty-four (24) hour technical support and access to the Web Portal 
and the reports it generates The Web Portal shall 

3 1.1 Enable the Department to conducl statistical analysis of Child Abuse 
Investigations where the outputs of the predictive model are accessible for daily use 

3 12 Contain outputs that include a prediction across live data, a cross tabulation 
of all findings from the historical data set, and a data worksheet allowing the User to 
navigate to investigation/case/participant detail as it pertains to the data provided 
combined with the outputs of the modeling 

3.1 3 Include support for a quality assurance survey in which questions may be 
imported into the survey and applied to any identified victim of child abuse or neglect 
at any time Reports shall also be included 

3.1 4 Provide ongoing maintenance of the predictive models to periodically 
incorporate ongoing case work 

3 2. The Contractor shall adapt the Web Portal to create reports that provide a customized 

predictive data sample of prioritized cases for review by the Department The 
Contractor shall provide additional reports as mutually agreed upon by the Contractor 
and the Department. 

3.3 The Contractor shall provide training to the Department on review completion portal 
entry teaming techniques, and action item tracking to support the Department s 
implementation of Eckerd Rapid Safety Feedback® 

3.4. The Contractor shall provide Department personnel with access to the Eckerd Rapid 
Safety Feedback® practice guide for use in connection with the Department s 
implementation and offer same day technical assistance from case review staff 
experienced in the review process 

3 5 The Contractor shall perform quarterly, on-site two (2) day fidelity reviews and 
coordinate sharing of best practices across jurisdictions through the Eckerd Rapid 
Safety Feedback® Community of Practice Each fidelity review shall be conducted to 

3 5 1 Allow for direct observation of the DCYF safety coaching process from start 
to finish, including sample selection through action item tracking 
3 5 2 Review case review results 
3.5.3 Identify trends in interrater reliability 
3 5 4 Ensure documentation is occurring according to standards 

Fckerd Youlh Alternatives, Inc. Exhibit A Conlraclor 
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3 5.5 Complete fidelity tools and comprehensive fidelity reports for site visits. 

3 6 The Contractor shall provide on*site training of newly hired QA staff and DCYF staff 
identified as fidelity coaches/reviewers. Training shall be scheduled immediately before 
or after the planned quarterly fidelity reviews. 

3 7 The Contractor shall provide a minimum of monthly case review coaching calls to 
Department staff For each newly hired DCYF Quality Assurance staff, the Contractor 
shall provide up to three (3) coaching sessions, which include remote observation via 
conference call or WebEx 

3 8 The Contractor shall provide consultation on the review and analysis of case 
practice change trend data and technical assistance to integrate case practice 
systemic findings into existing/emerging DCYF Continuous Quality Improvement 
(CQI) processes. 

3 9 The Contractor agrees that the Confidential Data obtained under this Agreement may 
not be used for any other purposes that are not indicated in this Agreement. The 
Contractor shall ensure that it, and its subcontractor, comply with Exhibit K of this 
Agreement, entitled 'DHHS Information Security Requirements.' which is attached 
hereto and incorporated by reference herein 

3 10 All data associated in any way with the Web Portal will be owned solely by the 
Department. 

3 11 The Contractor shall ensure that it, and its subcontractor, will not authorize or provide 
access to credentials to any person other than Department or Contractor employees 
who have a need for such access or credentials without the Department s prior written 
consent. 

3.12. The Contractor shall ensure that it, and its subcontractor, will not provide administrative 
level access to the Web Portal or any database or data storage system used by the 
Web Portal to any person without the Department s prior written consent. 

3.13. Each End User of the Contractor, and its subcontractor, who has access to the Web 
Portal will execute the attached End User Agreement (EUA), Attachment A, prior to 
accessing the CCWIS/SACWIS or extracted data, which confirms his/her duty to 
maintain all data and information relating to cases referenced in the Web Portal as 
strictly confidential. 

3 13 1. The Contractor must have a signed EUA for all of its End Users on file with 
DHHS, prior to DHHS sharing data with User This shall apply to any new 
User during the contract period. In addition, the Contractor shall notify the 
Department when a User is terminated or no longer needs access so that 
access may be terminated. 

3,13.2 The EUA must be signed and returned to DHHS to track disclosures of DHHS 
Data and to ensure that the End User only uses the DHHS Data and any 
derivative data for the purposes provided under the terms of this Agreement. 


3.14 The Department will allow the Contractor, and its subcontractor to acci 
Department's CCWIS/SACWIS system and/or extracted data on a daily ba 
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sole purpose of implementing Eckerd Rapid Safety Feedback® for the Department 
The Department will provide access to the client files of clients that died due to 
maltreatment and/or clients that experienced serious maltreatment while known to the 
Division for Children Youth and Families 

3 15 The Contractor will work with the Department to establish an agreed exchange protocol 
and accommodate the DCYF data exchange method and data packaging formats 
should portions of a new CCWIS/SACWIS that affect the RSF data exchange become 
operational during the contract period. The exchange protocol will include the 
specifications for the initial historical data package. The data elements to be shared are 
attached hereto and incorporated by reference herein as Attachment B 

3 16. The Department will provide sufficient reviewers to the Eckerd Rapid Safety 
Feedback® program, which will be dedicated QA staff that are not investigating or 
managing the case or providing supervision to the front line workers assigned to the 
case Reviewers will successfully complete Eckerd Rapid Safely Feedback® training 
(provided at no cost to the Department) prior to completing case reviews. 

3.17 The Department will participate in a quarterly Fidelity Review, sharing lessons learned 
with other jurisdictions, and report the results observed after implementation of Eckerd 
Rapid Safety Feedback® 

3 18 The Department will enter all case reviews into the Web Portal to provide automated 
tracking functionality dashboards, and data for the continuous improvement of existing 
predictive data sets for the Eckerd Rapid Safety Feedback® implementation in New 
Hampshire. 

3.19. The Department will provide the Contractor with written notice of any lawsuit of claim 
filed or asserted against the Department alleging liability in connection with Eckerd 
Rapid Safety Feedback® 

3.20. All CCWIS/SACWIS data will be deemed and treated as Confidential Information of the 
Department. All intellectual property rights in and to the CCWIS/SACWIS data will 
remain the sole property of the Department. By making CCWIS/SACWIS data available 
to the Contractor and its subcontractor, the Department grants to the Contractor a 
limited, non-exclusive, royalty-free, fully-paid-up license for the term of this Agreement 
to use the CCWIS/SACWIS data, but solely for the purpose of implementing Eckerd 
Rapid Safety Feedback® for the Department, providing the Portal and related reports, 
and improving Eckerd Rapid Safety Feedback® 

3 21. All intellectual property (IP) rights in and to EckerdRapid Safety Feedback®, the Web 
Portal and its related software and documentation, the reports generated by the Web 
Portal the Eckerd Rapid Safety Feedback® training materials, the Eckerd Rapid 
Safety Feedback® safety guide (including without limitation for all of the foregoing, all 
related inventions, processes, improvements, trade secrets algorithms, works of 
authorship, trademarks and service marks (jointly “Pre-existing IP ) is and will remain 
the sole property of the Contractor, its subcontractor and their licensors. All pre¬ 
existing IP will be deemed and treated as Confidential Information The Contractor 
hereby grants to the Department a limited, non exclusive, royalty free, fully-paid-up 
license for the term of this Agreement to use their pre-existing IP but solely for the 
purpose of implementing Eckerd Rapid Safety Feedback® 
subject to this Agreement and Portal Terms 

Eckerd Youth Alternatives. Inc Exhibit A 

d/b/a Eckerd Kids 
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3.22. By using the Web Portal, the Department agrees to abide by the Web Portal terms and 
any applicable laws including without limitation laws relating to privacy and personal 
identifying information relating to children 

3.23 At the sole discretion of the Department, employees of the Contractor and its 
subcontractor, may be subject to user background checks, based on the information 
systems accessed or types of data provided If requested the Contractor shall submit 
the required background checks to the Department in a timely manner 

3 24 The Contractor and its subcontractor shall use and disclose Protected Health 

Information in compliance with the Standards for Privacy of Individually Identifiable 
Health Information (Privacy Rule) (45 CFR Parts 160 and 164) under the Health 
Insurance Portability and Accountability Act (HIPAA) of 1996 and in accordance with 
the attached Business Associate Agreement (Exhibit I). which has been executed by 
the parties and is incorporated by reference herein 

4. Performance Measures 

4 1 The services provided by the Contractor shall meet the Recommendation 19 from the 

Quality Assurance Review of DCYF that was made final in 2016 to re-conceptualize 
the process of identifying safety threats and risks of harm associated with incoming 
reports of maltreatment. 

4 2 The Contractor shall assist the Department in meeting mandates for the Program 
Improvement Plan from the Child and Family Services Review, which identifies the 
need for improved assessment and management of the safety and risk for children and 
youth. If mandates for improvement are not met. the Department is subject to financial 
penalties. 


5. Deliverables 

5.1. The following deliverables shall be required. 

511 Provide training to the Department on review completion, portal entry, 

teaming techniques, and action item tracking to support the Department s 
implementation of Eckerd Rapid Safety Feedback® within six (6) months of 
the effective date of this agreement. 

5.1.2. Provide quarterly, on-site two (2) day fidelity reviews and coordinate sharing 
of best practices across jurisdictions through the Eckerd Rapid Safety 
Feedback® Community of Practice in the months of July. October, January 
and April for both years of this agreement, including on-site training of newly 
hired QA staff and DCYF staff identified as fidelity coaches/reviewers, 
immediately before or after the planned quarterly fidelity reviews 


6. Renewal 


6 1 The Department reserves the right to extend this agreement for up to four (4) additional 
years, contingent upon satisfactory delivery of services available funding written 
agreement of the parties and approval of the Governor and Executive Council 


Eckerd Youth Alternatives, Inc 
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ATTACHMENT A 


END USER AGREEMENT 

U> requesting and receiving approval to access live OIIIIS Data: 

• I understand dial I will have direel and indirect access u> c<lnliclc'ivliuI inlbrnialion in 
the course of performing mj work activities. 

■ I agree to proieel the confidential nature id'all inlbrnialion to which I have access. 

• I understand that there are suite and federal laws and regulations that ensure the 
confident in lit) of an indiv {dual's information. 

• I understand that there are 1)111 JS policies and agency procedures with which I am 
required to compl) related to the protection of indiv kluallv identiliahle information. 

• I understand that the information I will have direct and indirect access to shall not he 
shared outside the 1)1 II IS Scope of Work or related signed Contract. Memorandum 
of Understanding and.br Inlbrnialion l.xehangc Agreement'Data Sharing Agreement 
agreed upon. 

• I understand that mv SJ IT or am inlbrnialion security credentials a onuieior user 
name and password) should not he shared with anyone, this applies to credentials 
used to access the site direct!) or indirectly through a third part) application. 

• I will not disclose or make use of the identitv of am person or establishment 

discovered inadvertently I will report such discoveries uiihin Hivnty four '2-h h<>w\ 
to: DHHSliilbniiatiotiSeciiritvOffiyeV/ dhhs.nh.t>nv and 

DMIlSTrivaevOfnecrbdlih.s.nli.gijy and the 1)1 IDS Program Manager C ontact. 

• I will not implv or stale, either in written or oral Ibrm. that interpretations based on 
the data arc those of the original data sources or the Stale of New I lampshire unless 
the data use rand 1)111 IS are formal!) collaborating. 

• I will acknowledge, in all reports or presentations based on these data, the original 
source of the data. 

• I understand how I am expected to ensure the protection of individual!) identiliahle 
information. Should questions arise in the future about how to protect information 
to which I have access. I will immediate!) notify my supervisor. 

• I have been informed dial (his signed agreement will be retained on lile for future 
reference. 


Signature 


l)aLc 


Printed Name 


Title 



ATTACHMENT B 


DATA ELEMENTS 
I. Data Elements Involved 

Data elements involved in the project are amassed from twenty-four (24) data 
tables extracted from NH Bridges through the Enterprise Data Warehouse 
(EDW). These tables may be divided into five categories around: 

• Referrals 

■ Case and Case Information 

• Service and Placement Information 

• Client Information and Relations 

• Code Key Information 

What follows is a listing of the tables and a brief description of its contents 
organized within the five categories laid out above. 


Table Name 

Table Description 


iam_risk_Assessment_tbl 

1AM Risk Assessment. 

Referrals 

IAM_SAFETY_ASSESSMENT_TBL 

1AM 24 Hour Safety Assessment. 

Referrals 

IAM_SAFETY_REVIEW_TBl 

1AM Safety Review. 

Referrals 

TALLEGATION 

This table contains allegation information 
connected with a specific Referral. 

Referrals 

l! TINTERVIEW 

This table contains information on the contacts 
made with all of the clients and collaterals during 
the Referral Assessment process. 

Referrals 

TINVESTIGATION 

This table contains information collected during the 
Assessment investigation. 

Referrals 

TPERPETRATOR 

This table contains information about the alleged 
perpetrator associated with a Referral allegation. 

Referrals 

TREF_CLIENT 

This table contains information about each client in 
a specific Referral. 

Referrals 

TREF_FAMIIY_SAFETY 

This table contains information around family 
identified in the referral. 

Referrals 

TREFERRAL 

This table contains information about a DCYF 
referral - abuse/neglect, CHINS, or l&R. 

Referrals 

TCAS.CLIENT 

This table provides Information about the clients 
that are involved in a given case. 

Case and Case 
Information 

TCA5_CNTAC 

This table contains information about contacts 
made by the worker with any client or collateral in 
the case. 

Case and Case 
Information 

TCAS_HISTORY 

This table maintains the dates and reasons for each 
case opening and closing. 

Case and Case 
Information 









































TCASE 

This table provides information about each DCYF 
case. 

Case and Case 
Information 

TCCNT_PARTICIPANT 

This table maintains information on the participants 
of a case contact. 

Case and Case 
Information 

TCHLDJJNPD_PLACEMENT 

This table contains historic information about a 
child's unpaid placements. 

Service/Placement 

TCL_HMRMVL_HIST 

This table contains information on all of the 
occurrences of the child's being removed from his 
home by DCYF. 

Service/Placement 

TCl_SRVC 

This table holds the information about 
authorizations for a resource to provide services to 
a child at a specified rate, number of units and time 
frame, the generation of which initiates the claims 
process. 

Service/Placement 

CLIENT_MEDICAID_AUTH_TBL 

This table provides information about specific 
Medicaid service types authorized. 

Service/Placement 

IAM_HOUSEHOLD_TBL 

Households for which 1AM tools are completed. 

Client Information 
and Relationships 

TCL_ADDR 

This table contains information about the client's 
addresses. 

Client Information 
and Relationships 

TCL_RELTN 

This table contains information about the client's 
relationship with an associated client. 

Client Information 
and Relationships 

TCLIENT 

This gives information about the individual client 

Client Information 
and Relationships 

TCD_TBLVALUE 

This table provides a cross-reference of pick list 
code values to their long and short description so 
that other tables can store the code value rather 
than lengthy narratives. The codes are translated 
to the narratives on the user interface. 

Code Key 


The specific data elements per each table are further broken down in the data table mapping 
document. 
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the data model. This is only pertinent to NH in order to provide data during a 
specified time period and will not be used to link tables. 
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Method and Conditions Precedent to Payment 

1 The State shall pay the Contractor an amount not to exceed the Form P-37, Block 1 8, Price 
Limitation for the services provided pursuant to Exhibit A, Scope of Services 

2 This Agreement is funded with one-hundred percent (100%) General Funds 

3 Payment for said services shall be made monthly as follows 

3.1 Payment shall be made to the Contractor at the rale of $9,000 per month. 

3 2 The Contractor shall submit an invoice in a form satisfactory to the State by the twentieth 
working day of each month which identifies and requests reimbursement for authorized 
expenses incurred in the prior month 

3 3 The Contractor shall ensure the invoice is completed signed, dated and returned to the 
State in order to initiate payment 

3 4 The State shall make payment to the Contractor within thirty (30) days of receipt of each 
invoice, subsequent to approval of the submitted invoice and if sufficient funds are 
available 

4 The Contractor shall keep detailed records of their activities related to State-funded programs 
and services and have records available for Department review as requested. 

5 The final invoice shall be due to the State no later than forty (40) days after the contract 
completion date specified in Form P-37. General Provisions Block 1.7 Completion Date. 

6. In lieu of hard copies, all invoices may be assigned an electronic signature and emailed to 
dcyfinvoices@dhhs.nh.gov, or invoices may be mailed to: 

Financial Administrator 
Department of Health and Human Services 
Division of Children, Youth and Families 
129 Pleasant St. 

Concord, NH 03301 

7. Payments may be withheld pending receipt of required reports or documentation as identified 
in Exhibit A, Scope of Services and in this Exhibit B. 

8. Notwithstanding anything to the contrary herein, the Contractor agrees that funding under this 
agreement may be withheld, in whole or in part, in the event of non-compliance with any Federal 
or State law, rule or regulation applicable to the services provided or if the services have not 
been satisfactorily completed in accordance with the terms and conditions of this agreement. 


Ecfeerd Youth Alternatives, Inc 
d/b/a Eckerd Kids 
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Contractors Obligations. The Contractor covenants and agrees that all funds received by Ihe Contractor 
under Ihe Contract shall be used only as payment to the Contractor for services provided to eligible 
individuals and in the furtherance of the aforesaid covenants the Contractor hereby covenants and 
agrees as follows 


1 Compliance with Federal and State Laws: If the Contractor is permitted to determine Ihe eligibility 
of individuals such eligibility determination shall be made in accordance with applicable federal and 
state laws, regulations, orders guidelines, policies and procedures 


2 Time and Manner of Determination: Eligibility determinations shall be made on forms provided by 
the Department for that purpose and shall be made and remade at such times as are prescribed by 
the Department 


3 Documentation: In addition to the determination forms required by the Department the Contractor 
shall maintain a data file on each recipient of services hereunder which file shall include all 
information necessary to support an eligibility determination and such other information as the 
Department requests The Contractor shall furnish the Department with all forms and documentation 
regarding eligibility determinations that the Department may request or require 

4 Fair Hearings: The Contractor understands that all applicants for services hereunder as well as 
individuals declared ineligible have a right to a fair hearing regarding that determination The 
Contractor hereby covenants and agrees that all applicants for services shall be permitted lo fill out 
an application form and that each applicant or re-applicant shall be informed of his/her right to a fair 
hearing in accordance with Department regulations 

& Gratuities or Kickbacks: The Contractor agrees that it is a breach of this Contract to accept or 
make a payment gratuity or offer of employment on behalf of Ihe Contractor any Sub-Contractor or 
the State in order to influence the performance of the Scope of Work detailed in Exhibit A of this 
Contract The State may terminate this Contract and any sub contract or sub-agreement if it is 
determined that payments, gratuities or offers of employment of any kind were offered or received by 
any officials, officers, employees or agents of (he Contractor or Sub-Contractor 

6 Retroactive Payments: Notwithstanding anything lo the contrary contained in the Contract or many 
other document, contract or understanding, it is expressly understood and agreed by the parties 
hereto that no payments will be made hereunder to reimburse the Contractor for cosls incurred for 
any purpose or for any services provided lo any individual prior to the Effective Dale of the Contract 
and no payments shall be made for expenses incurred by the Contractor for any services provided 
prior lo the date on which the individual applies for services or (except as otherwise provided by the 
federal regulations) prior to a determination that the individual is eligible for such services 

7 Conditions of Purchase: Notwithstanding anything to the contrary contained in the Contract nothing 
herein contained shall be deemed lo obligate or require the Department to purchase services 
hereunder at a rate which reimburses the Contractor in excess of the Contractors costs at a rate 
which exceeds the amounts reasonable and necessary to assure the quality of such service or at a 
rate which exceeds the rate charged by the Contractor to ineligible individuals or other third party 
funders for such service. If at any lime during the term of this Contract or after receipt of the Final 
Expenditure Report hereunder the Department shall determine that the Contractor has used 
payments hereunder to reimburse items of expense other than such costs, or has received payment 
in excess of such costs or in excess of such rates charged by the Contractor to ineligible individuals 
or other third party funders the Department may elect to 


7 1 
7.2 


Renegotiate the rates for payment hereunder in which event new rales shall be established; 
Deduct from any future payment to the Contractor the amount of any prior reimburseTrtBQluK 
excess of costs X/ 
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7 3 Demand repayment of the excess payment by the Contractor m which event failure to make 

such repayment shall constitute an Event of Default hereunder When the Contractor is 
permitted to determine the eligibility of individuals for services the Contractor agrees to 
reimburse the Department for all funds paid by the Department to the Contractor for services 
provided to any individual who is found by the Department to be ineligible for such services at 
any time during the period of retention of records established herein 

RECORDS MAINTENANCE. RETENTION. AUDIT DISCLOSURE AND CONFIDENTIALITY 

8 Maintenance of Records: In addition to the eligibility records specified above theContractor 
covenants and agrees to maintain the following records during the Contract Period 

8 1 Fiscal Records books records, documents and other data evidencing and reflecting all costs 

and other expenses incurred by the Contractor in the performance of the Contract, and all 
income received or collected by the Contractor during the Contract Period said records to be 
maintained in accordance with accounting procedures and practices which sufficiently and 
properly reflect all such costs and expenses and winch are acceptable to the Department and 
to include, without limitation, all ledgers, books records and original evidence of costs such as 
purchase requisitions and orders, vouchers, requisitions for materials, inventories valuations of 
in-kind contnbutions labor time cards payrolls and other records requested or required by the 
Department 

8 2 Statistical Records Statistical, enrollment, attendance or visit records for each recipient of 
services during the Contract Period, which records shall include all records of application and 
eligibility (including all forms required to determine eligibility for each such recipient) records 
regarding the provision of services and all invoices submitted to the Department to obtain 
payment for such services 

8 3 Medical Records Where appropriate and as prescribed by the Department regulations the 

Contractor shall retain medical records on each patient/recipient of services 

9 Audit: Contractor shall submit an annual audit to the Department within 60 days after the close of the 
agency fiscal year It is recommended that the report be prepared in accordance with the provision of 
Office of Management and Budget Circular A-133. "Audits of States, Local Governments, and Non 
Profit Organizations” and the provisions of Standards for Audit of Governmental Organizations 
Programs. Activities and Functions, issued by the US General Accounting Office (GAO standards) as 
they pertain to financial compliance audits 

9 1 Audit and Review During the term of this Contract and the period for retention hereunder the 

Department, the United Stales Department of Health and Human Services, and any of their 
designated representatives shall have access to all reports and records maintained pursuant to 
the Contract for purposes of audit, examination, excerpts and transcripts. 

9 2 Audit Liabilities. In addition to and not in any way in limitation of obligations of the Contract, it is 
understood and agreed by the Contractor that the Contractor shall be held liable for any state 
or federal audit exceptions and shall return to the Department, all payments made under the 
Contract to which exception has been taken or which have been disallowed because of such an 
exception 

10 Confidentiality of Records: All information, reports and records maintained hereunder or collected 
in connection with the performance of the services and the Contract shall be confidential and shall not 
be disclosed by the Contractor provided however, that pursuant to state laws and the regulations of 
the Department regarding the use and disclosure of such information, disclosure may be made to 
public officials requiring such information in connection with their official duties and for purposes 
directly connected to the administration of the services and the Contract, and provided further, that 
the use or disclosure by any party of any information concerning a recipient for any purpose not 
directly connected with the administration of the Department or the Contractor’s responsibilities with 
respect to purchased services hereunder is prohibited except on written consent of the reqpidhLhis 
attorney or guardian 

Contractor 

Dale 3/30'19 
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Notwithstanding anything to the contrary contained herein the covenants and conditions contained in 
the Paragrapti shall survive the termination of the Contract for any reason whatsoever 

11 Reports: Fiscal and Statistical The Contractor agrees to submit the following reports at Ihe following 
limes if requested by the Department 

11 1 Interim Financial Reports Written interim financial reports containing a detailed description of 
all costs and non-allowable expenses incurred by the Contractor to the date of the report and 
containing such other information as shall be deemed satisfactory by the Department to 
justify the rate of payment hereunder Such Financial Reports shall be submitted on the form 
designated by the Department or deemed satisfactory by the Department 
11 2 Final Report A final report shall be submitted within thirty (30) days after the end of the term 
of this Contract. The Final Report shall be in a form satisfactory to the Department and shall 
contain a summary statement of progress toward goals and objectives stated in the Proposal 
and other information required by the Department. 

12 Completion of Services: Disallowance of Costs Upon the purchase by the Department of the 
maximum number of units provided for in the Contract and upon payment of the price limitation 
hereunder the Contract and all the obligations of the parties hereunder (except such obligations as 
by the terms of the Contract are to be performed after Ihe end of the term of this Contract and/or 
survive the termination of the Contract) shall terminate, provided however, that if upon review of the 
Final Expenditure Report the Department shall disallow any expenses claimed by the Contractor as 
costs hereunder the Department shall retain the right, at its discretion to deduct the amount of such 
expenses as are disallowed or to recover such sums from the Contractor 

13 Credits: All documents, notices press releases research reports and other materials prepared 
during or resulting from the performance of the services of Ihe Contract shall include the following 
statement' 

13 1 The preparation of this (report, document etc.) was financed under a Contract with the State 
of New Hampshire, Department of Health and Human Services with funds provided in part 
by the State of New Hampshire and/or such other funding sources as were available or 
required, e g , the United States Department of Health and Human Services 

14 Prior Approval and Copyright Ownership: All materials (written, video, audio) produced or 
purchased under the contract shall have prior approval from DHHS before printing production, 
distribution or use. The DHHS will retain copyright ownership for any and all original materials 
produced, including, but not limited to, brochures, resource directories protocols or guidelines 
posters or reports. Contractor shall not reproduce any materials produced under the contract without 
prior written approval from DHHS 



15 Operation of Facilities: Compliance with Laws and Regulations: In the operation of any facilities 
for providing services, the Contractor shall comply with all laws, orders and regulations of federal, 
state, county and municipal authorities and with any direction of any Public Officer or officers 
pursuant to laws which shall impose an order or duly upon the contractor with respect lo the 
operation of the facility or the provision of the services at such facility If any governmental license or 
permit shall be required for the operation of the said facility or the performance of the said services, 
the Contractor will procure said license or permit and will at all times comply with the terms and 
conditions of each such license or permit. In connection with the foregoing requirements the 
Contractor hereby covenants and agrees that, during the term of this Contract the facilities shall 
comply with all rules, orders regulations, and requirements of the State Office of the Fire Marshaland 
the local fire protection agency and shall be in conformance with local building and zoning codes by¬ 
laws and regulations 

16 Equal Employment Opportunity Plan (EEOP): The Contractor will provide an Equal Employment 
Opportunity Plan (EEOP) to the Office for Civil Rights. Office of Justice Programs (OCR) if it has 
received a single award of S500 000 or more If the recipient receives S25 000 or more and‘hasher 
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more employees, it will maintain a current EEOP on file and submit an EEOP Certification Form to the 
OCR certifying that its EEOP is on file For recipients receiving less than S25.000. or public grantees 
with fewer than 50 employees regardless of the amount of the award the recipient will provide an 
EEOP Certification Form to the OCR certifying it is not required to submit or maintain an EEOP Non¬ 
profit organizations Indian Tribes and medical and educational institutions are exempt from the 
EEOP requirement, but are required to submit a certification form to the OCR to claim the exemption 
EEOP Certification Forms are available at httpV/www ojp usdoj/about/ocr/pdfs/cert pdf 

17 Limited English Proficiency (LEP): As clarified by Executive Order 13166 Improving Access to 
Services for persons with Limited English Proficiency and resulting agency guidance national origin 
discrimination includes discrimination on the basis of limited English proficiency (LEP) To ensure 
compliance with the Omnibus Cnme Control and Safe Streets Act of 1968 and Title VI of the Civil 
Rights Act of 1964 Contractors must take reasonable steps to ensure that LEP persons have 
meaningful access to its programs 


18 Pilot Program for Enhancement of Contractor Employee Whistleblower Protections: The 
following shall apply to all contracts that exceed the Simplified Acquisition Threshold as defined in 48 
CFR 2 101 (currently, 3150,000) 

Contractor Employee Whistleblower Rights and Requirement To Inform Employees of 

Whistleblower Rights jSEP 2013) 

(a) This contract and employees working on this contract will be subject to the whistleblower rights 
and remedies in the pilot program on Contractor employee whistleblower protections established at 
41 U S C 4712 by section 828 of the National Defense Authorization Act for Fiscal Year 2013 (Pub L 
112-239) and FAR 3 908 

(b) The Contractor shall inform its employees in writing in the predominant language of the workforce 
of employee whistleblower rights and protections under 41 U S.C 4712 as described in section 

3 908 of the Federal Acquisition Regulation 

(c) The Contractor shall insert the substance of this clause including this paragraph (c). in all 
subcontracts over the simplified acquisition threshold 

19 Subcontractors: DHHS recognizes that the Contractor may choose to use subcontractors with 
greater expertise to perform certain health care services or functions for efficiency or convenience, 
but the Contractor shall retain the responsibility and accountability for the function(s) Prior to 
subcontracting, the Contractor shall evaluate the subcontractor's ability to perform the delegated 
funclion(s). This is accomplished through a written agreement that specifies activities and reporting 
responsibilities of the subcontractor and provides for revoking the delegation or imposing sanctions if 
the subcontractor's performance is not adequate. Subcontractors are subject to the same contractual 
conditions as the Contractor and the Contractor is responsible to ensure subcontractor compliance 
with those conditions. 


When the Contractor delegates a function to a subcontractor, the Contractor shall do the following 


191 

192 

193 


Evaluate the prospective subcontractors ability to perform the activities before delegating 
the function 

Have a written agreement with the subcontractor that specifies activities and reporting 
responsibilities and how sanctions/revocation will be managed if the subcontractors 
performance is not adequate 

Monitor the subcontractor s performance on an ongoing basis 
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19 4 Provide to DHHS an annual schedule identifying all subcontractors delegated functions and 
responsibilities, and when the subcontractors performance will be reviewed 
19 5 DHHS shall at its discretion, review and approve all subcontracts 

If the Contractor identifies deficiencies or areas for improvement are dentified the Contractor shall 
take corrective action 


20 Contract Definitions: 

20 1 COSTS Shall mean those direct and indirect items of expense determined by the Department 
to be allowable and reimbursable in accordance with cost and accounting principles established 
in accordance with state and federal laws regulations, rules and orders 

20 2 DEPARTMENT' NH Department of Health and Human Services 

20 3 PROPOSAL If applicable, shall mean the document submitted by the Contractor on a 

form or forms required by the Department and containing a description of the services and/or 
goods to be provided by the Contractor in accordance with the terms and conditions of the 
Contract and setting forth the total cost and sources of revenue for each service to be provided 
under the Contract 

20 4 UNIT For each service that the Contractor is to provide to eligibfe individuals hereunder, shall 
mean that period of time or that specified activity determined by the Department and specified 
in Exhibit B of the Contract. 

20 5 FEDERAL/STATE LAW Wherever federal or state laws regulations, rules, orders, and 
policies, etc are referred to in the Contract the said reference shall be deemed to mean 
all such laws regulations etc. as they may be amended or revised from lime to lime 

20.6 SUPPLANTING OTHER FEDERAL FUNDS Funds provided to the Contractor under this 
Contract will not supplant any existing federal funds available for these services 
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REVISIONS TO STANDARD CONTRACT LANGUAGE 


1. Revisions to Form P-37, General Provisions 


1 1 Section 4, Conditional Nature of Agreement , is replaced as follows 


4 CONDITIONAL NATURE OF AGREEMENT 


Notwithstanding any provision of this Agreement to the contrary, all obligations of 
the State hereunder, including without limitation, the continuance of payments in 
whole or in part, under this Agreement are contingent upon continued appropriation 
or availability of funds, including any subsequent changes to the appropriation or 
availability of funds affected by any state or federal legislative or executive action 
that reduces, eliminates, or otherwise modifies the appropriation or availability of 
funding for this Agreement and the Scope of Services provided in Exhibit A. Scope 
of Services in whole or in part In no event shall the State be liable for any 
payments hereunder in excess of appropriated or available funds In the event of a 
reduction termination or modification of appropriated or available funds, the State 
shall have the right to withhold payment until such funds become available if ever 
The State shall have the right to reduce, terminate or modify services under this 
Agreement immediately upon giving the Contractor notice of such reduction, 
termination or modification The State shall not be required to transfer funds from 
any other source or account into the Account(s) identified in block 1 6 of the 
General Provisions, Account Number, or any other account in the event funds are 
reduced or unavailable. 


1.2 Section 10, Termination , is amended by adding the following language 

10.1 Either parly may unilaterally terminate this Agreement at any time for any 

reason, thirty (30) days after giving the other party written notice that the party is 
exercising its option to terminate the Agreement, or at a later date specified in 
the notice. However, in no instance shall such a termination be effective prior to 
the return or destruction of all Confidential Data provided to the Contractor by 
the Department or derived from the Confidential Data obtained under the terms 
of this Agreement. The Contractor agrees that it has the duty to protect and 
maintain the privacy and security of Confidential Data and that duty must 
continue in full force and effect until such Confidential Data is returned and/or 
destroyed. For any Confidential Data or derivative data that destruction is not 
feasible for. the privacy and security requirements of this Agreement must 
survive the termination or expiration of this Agreement. 


10 2 If the State determines that there was or may have been an Incident or Breach of 
the Confidential Data or individually identifiable derivative data or information by 
the User, its End Users, subcontractors and/or agenls that violates the terms of 
this Agreement, DHHS may. in its sole discretion, immediately and unilaterally 
terminate this Agreement upon notice to the Contractor, and immediately revoke 
all access to the Bridges System. The Contractor agrees to cease using and 
return and/or destroy all Confidential Data and derivatives therefrom in its 
possession, End Users' subcontractors’/agenls' possession, immediately upon 
notice of termination for an Incident or Breach. User agrees that it has the duty to 
protect and maintain the privacy and security of Confidential Data and that duty 
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must continue in full force and effect until such data is returned and/or destroyed. 
For any such data that return/destruction is not feasible, the privacy and security 
requirements of this Agreement shall survive the termination. 

10 3ln the event of an early termination for any reason, the Contractor shall, within 
fifteen (15) days of notice of early termination develop and submit to the State a 
Transition Plan for services under the Agreement, including but not limited to the 
return and/or destruction of Confidential data 

10 4 The Contractor shall fully cooperate with the State and shall promptly provide 
detailed information to support the Transition Plan including but not limited to any 
information or data requested by the State related to the termination of the 
Agreement and Transition Plan and shall provide ongoing communication and 
revisions of the Transition Plan to the State as requested 

2. Revisions to Standard Exhibits 
2 1 Exhibit C. Special Provisions 


2 1.1 Paragraph 1, Compliance with Federal and State Laws, is deleted in its 
entirety. 

2 1 2 Paragraph 2, Time and Manner of Determination is deleted in its entirety 

2 13 Paragraph 3 Documentation, is deleted in its entirety 

2 1 4 Paragraph 4, Fair Hearings, is deleted in its entirely 

2.1.5 Paragraph 6, Retroactive Payments, is deleted in its entirety 

2 16 Paragraph 7. Conditions of Purchase, and its subparagraphs, are deleted in 

their entirety 

2 17 Paragraph 8. Maintenance of Records; Subparagraph 8.1. Fiscal Records, is 
replaced as follows: 

8.1. Fiscal Records: books, records, documents and other data evidencing 
and reflecting all costs and other expenses incurred by the Contractor in 
the performance of the Contract, and all income received or collected 
by the Contractor during the Contract Period, said records to be 
maintained in accordance with accounting procedures and practices 
which sufficiently and properly reflect all such costs and expenses, and 
to include without limitation, all ledgers books, records, and original 
evidence of costs such as purchase requisitions and orders, vouchers 
and requisitions for materials 

Subparagraphs 8 2 and 8 3 of Paragraph 8 are deleted in their entirety 
2 18 Paragraph 15, Operation of Facilities, is deleted in its entirety. 

2 19 Paragraph 17, Limited English Proficiency, is deleted in its entirety 
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CERTIFICATION REGARDING DRUG-FREE WORKPLACE REQUIREMENTS 

The Vendor identified in Section 1 3 of the General Provisions agrees lo comply with the provisions of 
Sections 5151-5160 of the Drug-Free Workplace Act of 1988 (Pub L 100-690 Tide V Subtitle D 41 
USC 701 el seq), and further agrees to have the Contractors representative, as identified in Sections 
1 11 and 1 12 of the General Provisions execute the following Certification 

ALTERNATIVE I - FOR GRANTEES OTHER THAN INDIVIDUALS 

US DEPARTMENT OF HEALTH AND HUMAN SERVICES - CONTRACTORS 
US DEPARTMENT OF EDUCATION - CONTRACTORS 
US DEPARTMENT OF AGRICULTURE - CONTRACTORS 

This certification is required by the regulations implementing Sections 5151-5160 of the Drug-Free 
Workplace Act of 1988 (Pub L 100-690 Title V. Subtitle D. 41 U S.C. 701 et seq.) The January 31 
1989 regulations were amended and published as Part II of the May 25 1990 Federal Register (pages 
21681-21691) and require certification by grantees (and by inference sub-grantees and sub¬ 
contractors), prior to award, that they will maintain a drug-free workplace Section 3017 630(c) of the 
regulation provides that a grantee (and by inference, sub-grantees and sub-contractors) that is a State 
may elect to make one certification to the Department in each federal fiscal year in lieu of certificates for 
each grant during the federal fiscal year covered by the certification The certificate set out below is a 
material representation of fact upon which reliance is placed when the agency awards the grant False 
certification or violation of the certification shall be grounds for suspension of payments, suspension or 
termination of grants or government wide suspension or debarment. Contractors using this form should 
send it to 


Commissioner 

NH Department of Health and Human Services 
129 Pleasant Street 
Concord NH 03301-6505 


1. The grantee certifies that it will or will continue to provide a drug-free workplace by 

1 1. Publishing a statement notifying employees that the unlawful manufacture, distribution 
dispensing, possession or use of a controlled substance is prohibited in the grantee s 
workplace and specifying the actions that will be taken against employees for violation of such 
prohibition, 

1.2 Establishing an ongoing drug-free awareness program to inform employees about 
1.2.1 The dangers of drug abuse in the workplace 

1.2 2 The grantee's policy of maintaining a drug-free workplace, 

1.2 3. Any available drug counseling, rehabilitation and employee assistance programs, and 
1.2.4. The penalties that may be imposed upon employees for drug abuse violations 
occurring in the workplace 

1.3. Making it a requirement that each employee to be engaged in the performance of the grant be 
given a copy of the statement required by paragraph (a). 

14 Notifying the employee in the statement required by paragraph (a) that as a condition of 
employment under the grant, the employee will 
1.41. Abide by the terms of the statement, and 

1.4.2. Notify the employer in writing of his or her conviction for a violation of a criminal drug 
statute occurring in the workplace no later than five calendar days after such 
conviction 

1 5. Notifying the agency in writing, within ten calendar days after receiving notice under 

subparagraph 1 4.2 from an employee or otherwise receiving actual notice of such conviction. 
Employers of convicted employees must provide notice, including position title, to every grant 
officer on whose grant activity the convicted employee was working, unless the Federal agency 
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has designated a central point for the receipt of such notices. Notice shall include the 
identification number(s) of each affected grant 
1.6. Taking one of the following actions within 30 calendar days of receiving notice under 
subparagraph 1*4.2. with respect to any employee who is so convicted 
1.6 1 Taking appropriate personnel action against such an employee up to and including 
termination consistent with the requirements of the Rehabilitation Act of 1973 as 
amended: or 

1.6.2. Requiring such employee to participate satisfactorily in a drug abuse assistance or 

rehabilitation program approved for such purposes by a Federal Stale or Eocal health 
law enforcement, or other appropriate agency. 

1.7 Making a good faith effort to continue to maintain a drug-free workplace through 
implementation of paragraphs 1.1 1.2 1,3. 1 4 15. and 1.6. 

2 The grantee may insert in the space provided below the sile(s) for the performance of work done in 
connection with the specific grant. 

Place of Performance (street address city county state zip code) (list each location) 

100 North Starcrest Drive, Clearwater. Pinellas County, I I 33^63 

1S93S North Dale Mabry Highway, Suite 10 2 , Lutz h Hillsborough County, H 3354S 

Check □ if there are workplaces on file that are not identified here 


Vendor Name Ixkerd Youth Alternatives, Inc. 



Date Name David Dennis 

Title President 
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CERTIFICATION REGARDING LOBBYING 

The Vendor identified in Section 1.3 of the General Provisions agrees to comply with the provisions of 
Section 319 of Public Law 101-121 Government wide Guidance for New Restrictions on Lobbying and 
31 U.S.C 1352 and further agrees to have the Contractor s representative, as identified in Sections 1 11 
and 1.12 of the General Provisions execute the following Certification 

US DEPARTMENT OF HEALTH AND HUMAN SERVICES - CONTRACTORS 
US DEPARTMENT OF EDUCATION - CONTRACTORS 
US DEPARTMENT OF AGRICULTURE - CONTRACTORS 

Programs (indicate applicable program covered) 

"Temporary Assistance to Needy Families under Title IV-A 
•Child Support Enforcement Program under Title IV-D 
•Social Services Block Grant Program under Title XX 
'Medicaid Program under Title XIX 
•Community Services Block Grant under Title VI 
'Child Care Development Block Grant under Title IV 


The undersigned certifies, to the best of his or her knowledge and belief that 

1. No Federal appropriated funds have been paid or will be paid by or on behalf of the undersigned to 
any person for influencing or attempting to influence an officer or employee of any agency a Member 
of Congress, an officer or employee of Congress or an employee of a Member of Congress in 
connection with the awarding of any Federal contract continuation, renewal amendment or 
modification of any Federal contract: grant, loan or cooperative agreement (and by specific mention 
sub-grantee or sub-contractor) 

2 If any funds other than Federal appropriated funds have been paid or will be paid to any person for 
influencing or attempting to influence an officer or employee of any agency, a Member of Congress 
an officer or employee of Congress, or an employee of a Member of Congress in connection with this 
Federal contract grant loan or cooperative agreement (and by specific mention sub-grantee or sub¬ 
contractor) the undersigned shall complete and submit Standard Form LLL (Disclosure Form to 
Report Lobbying, in accordance with its instructions attached and identified as Standard Exhibit E-l) 

3. The undersigned shall require that the language of this certification be included in the award 

document for sub-awards at all tiers (including subcontracts sub-grants, and contracts under grants, 
loans and cooperative agreements) and that all sub-recipients shall certify and disclose accordingly 

This certification is a material representation of fact upon which reliance was placed when this transaction 
was made or entered into. Submission of this certification is a prerequisite for making or entering into this 
transaction imposed by Section 1352. Title 31. U.S. Code. Any person who fails to fife the required 
certification shall be subject to a civil penalty of not less than S10 000 and not more than SI00.000 for 
each such failure. 
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Vendor Name hekerd Youth Altemuiives, Inc 



Name 

Title 


David Dennis 
Pres idem 
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CERTIFICATION REGARDING DEBARMENT. SUSPENSION 
AND OTHER RESPONSIBILITY MATTERS 

The Vendor identified in Section 1 3 of Ihe General Provisions agrees io comply with ihe provisions ol 
Executive Office of the President, Executive Order 12549 and 45 CFR Part 76 regarding Debarment 
Suspension and Other Responsibility Matters, and further agrees to have the Contractor's 
representative as identified in Sections 1.11 and 1 12 of the General Provisions execule the following 
Certification 


INSTRUCTIONS FOR CERTIFICATION 

1 By signing and submitting this proposal (contract), the prospective primary participant is providing the 
certification set out below 

2. The inability of a person to provide the certification required below will not necessarily result in denial 
of participation in this covered transaction. If necessary Ihe prospective participant shall submit an 
explanation of why it cannot provide the certification The certification or explanation will be 
considered in connection with the NH Department of Health and Human Services (DHHS) 
determination whether to enter into this transaction However failure of the prospective primary 
participant to furnish a certification or an explanation shall disqualify such person from participation in 
this transaction 

3 The certification in this clause is a material representation of fact upon which reliance was placed 
when DHHS determined to enter into this transaction. If it is later determined that Ihe prospective 
primary participant knowingly rendered an erroneous certification, in addition to other remedies 
available to the Federal Government. DHHS may terminate this transaction for cause or default 

4 The prospective primary participant shall provide immediate written notice to the DHHS agency to 
whom this proposal (contract) is submitted if at any time Ihe prospective primary participant learns 
that its certification was erroneous when submitted or has become erroneous by reason of changed 
circumstances. 


5. The terms covered transaction 'debarred, suspended' ineligible, lower tier covered 
transaction.' participant," person." "primary covered transaction," 'principal," proposal." and 
"voluntarily excluded." as used in this clause have the meanings set out in the Definitions and 
Coverage sections of the rules implementing Executive Order 12549 45 CFR Part 76 See the 
attached definitions. 


6. The prospective primary participant agrees by submitting this proposal (contract) that should the 
proposed covered transaction be entered into, it shall not knowingly enter into any lower tier covered 
transaction with a person wtio is debarred suspended, declared ineligible or voluntarily excluded 
from participation in this covered transaction, unless authorized by DHHS. 

7 The prospective primary participant further agrees by submitting this proposal that it will include the 
clause titled' Certification Regarding Debarment, Suspension Ineligibility and Voluntary Exclusion - 
Lower Tier Covered Transactions." provided by DHHS without modification, in all lower tier covered 
transactions and in all solicitations for lower tier covered transactions. 


8 A participant in a covered transaction may rely upon a certification of a prospective participant in a 
lower tier covered transaction that it is not debarred suspended, ineligible, or involuntarily excluded 
from the covered transaction, unless it knows that the certification is erroneous A participant may 
decide the method and frequency by which it determines the eligibility of its principals. Each 
participant may. but is not required to. check the Nonprocurement List (of excluded parties). 


9 


Nothing contained in the foregoing shall be construed to require establishment of a system of records 
in order to render m good faith the certification required by this clause. The knowledge and —^ 
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information of a participant is not required to exceed that which is normally possessed by a prudent 
person in the ordinary course of business dealings. 


10 Except for transactions authorized under paragraph 6 of these instructions if a participant in a 
covered transaction knowingly enters into a lower tier covered transaction with a person who is 
suspended debarred, ineligible or voluntarily excluded from participation in this transaction in 
addition to other remedies available to the Federal government DHHS may terminate this transaction 
for cause or default. 


PRIMARY COVERED TRANSACTIONS 

11 The prospective primary participant certifies to the best of its knowledge and belief that it and its 
principals 

11 1 are not presently debarred suspended proposed for debarment, declared ineligible or 
voluntarily excluded from covered transactions by any Federal department or agency 
11 2 have not within a three-year period preceding this proposal (contract) been convicted of or had 
a civil judgment rendered against them for commission of fraud or a criminal offense tn 
connection with obtaining, attempting to obtain or performing a public (Federal State or local) 
transaction or a contract under a public transaction, violation of Federal or Stale antitrust 
statutes or commission of embezzlement theft forgery bribery, falsification or destruction of 
records making false statements or receiving stolen property 
113. are not presently indicted for otherwise criminally or civilly charged by a governmental entity 
(Federal. State or local) with commission of any of the offenses enumerated in paragraph (l)(b) 
of this certification, and 

114 have not within a three-year period preceding this application/proposal had one or more public 
transactions (Federal, State or local) terminated for cause or default 

12. Where the prospective primary participant is unable to certify to any of the statements in this 
certification such prospective participant shall attach an explanation to this proposal (contract) 

LOWER TIER COVERED TRANSACTIONS 

13. By signing and submitting this lower tier proposal (contract), the prospective lower tier participant as 
defined in 45 CFR Part 76 certifies to the best of its knowledge and belief that it and its principals 
13.1 are not presently debarred, suspended, proposed lor debarment, declared ineligible, or 

voluntarily excluded Irom participation in this transaction by any federal department or agency 
13 2 where the prospective lower tier participant is unable to certify to any of the above such 
prospective participant shall altach an explanation to this proposal (contract). 

14 The prospective lower tier participant further agrees by submitting this proposal (contract) that it will 
include this clause entitled Certification Regarding Debarment. Suspension. Ineligibility, and 
Voluntary Exclusion - Lower Tter Covered Transactions ' without modification in all lower tier covered 
transactions and in all solicitations for lower tier covered transactions. 
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David Dennis 
President 
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CERTIFICATION OF COMPLIANCE WITH REQUIREMENTS PERTAINING TO 
FEDERAL NONDISCRIMINATION. EQUAL TREATMENT OF FAITH-BASED ORGANIZATIONS AND 

WHISTLEBLOWER PROTECTIONS 


The Vendor identified in Section 1.3 of the General Provisions agrees by signature of the Contractor s 
representative as identified in Sections 111 and 1 12 of the General Provisions to execute the following 
certification 

Vendor will comply and will require any subgranlees or subcontractors to comply with any applicable 
federal nondiscrimination requirements which may include 

- the Omnibus Crime Control and Sale Streets Act of 1968 (42 U S C. Section 3789d) which prohibits 
recipients of federal funding under this statute from discriminating, either in employment practices or in 
the delivery of services or benefits on the basis of race color religion national origin, and sex The Acl 
requires certain recipients to produce an Equal Employment Opportunity Plan. 

- the Juvenile Justice Delinquency Prevention Act of 2002 (42 U S C Section 5672(b)) which adopts by 
reference, the civil rights obligations of the Safe Streets Act. Recipients of federal funding under this 
statute are prohibited from discriminating, either in employment practices or in the delivery of services or 
benefits, on the basis of race, color, religion, national origin and sex The Act includes Equal 
Employment Opportunity Plan requirements 

- (he Civil Rights Act of 1964 (42 U S C Section 2000d which prohibits recipients of federal financial 
assistance from discriminating on the basis of race color or national origin in any program or activity). 

- the Rehabilitation Act of 1973 (29 U S.C Section 794), which prohibits recipients of federal financial 
assistance from discriminating on the basis of disability m regard to employment and the delivery of 
services or benefits, in any program or activity 

- the Americans with Disabilities Act of 1990 (42 U S C Sections 12131-34) which prohibits 
discrimination and ensures equal opportunity for persons with disabilities in employment. State and local 
government services, public accommodations, commercial facilities and transportation 

- the Education Amendments of 1972 (20 U S C Sections 1681,1683, 1685-86) which prohibits 
discrimination on the basis of sex in federally assisted education programs 

- the Age Discnmination Act of 1975 (42 U S C Sections 6106-07) which prohibits discrimination on the 
basis of age in programs or activities receiving Federal financial assistance It does not include 
employment discrimination, 

- 28 C F R pt 31 (U S Department of Justice Regulations - OJJDP Grant Programs) 28 C F R pt 42 
(U S Department of Justice Regulations - Nondiscrimination, Equal Employment Opportunity, Policies 
and Procedures). Executive Order No 13279 (equal protection of the laws for faith-based and community 
organizations); Executive Order No 13559. which provide fundamental principles and policy-making 
criteria for partnerships with faith-based and neighborhood organizations, 

- 28 C.F R. pt 38 (U S Department of Justice Regulations - Equal Treatment for Faith-Based 
Organizations), and Whistleblower protections 41 U S C §4712 and The National Defense Authorization 
Act fNDAA) for Fiscal Year 2013 (Pub. L 112 239 enacted January 2. 2013) the Pilot Program for 
Enhancement of Contract Employee Whistleblower Protections, which protects employees against 
reprisal for certain whistle blowing activities in connection with federal grants and contracts 

The certificate set out below is a material representation of fact upon which reliance is placed when the 
agency awards the grant False certification or violation of the certification shall be grounds for 
suspension of payments suspension or termination of grants, or government wide suspension or 
debarment 
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In the event a Federal or State court or Federal or State administrative agency makes a finding of 
discrimination after a due process hearing on the grounds of race color religion national origin, or sex 
against a recipient of funds the recipient will forward a copy of the finding to the Office for Civil Rights to 
the applicable contracting agency or division within the Department of Health and Human Services and 
to the Department of Health and Human Services Office of the Ombudsman 


The Vendor identified in Section 1.3 of the General Provisions agrees by signature of the Contractor s 
representative as identified in Sections 1 11 and 1 12 of the General Provisions to execute the following 
certification 

1. By signing and submitting this proposal (contract) the Vendor agrees to comply with the provisions 
indicated above 


Vendor Name KkcnJ Youth Alternative*. Inc 



Co- f --V t»* Cc'T ft-ce : if'ia " -j t? f v • ~ i a .ri 1 «! t n— /rr ~.'i 
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CERTIFICATION REGARDING ENVIRONMENTAL TOBACCO SMOKE 


Public Law 103-227, Pari C - Environmental Tobacco Smoke also known as the Pro-Children Act of 1994 
(Act) requires that smoking not be permitted in any portion of any indoor facility owned or leased or 
contracted for by an entity and used routinely or regularly for the provision of health day care education 
or library services to children under Ihe age of IB. if the services are funded by Federal programs either 
directly or through State or local governments by Federal grant contract, loan, or loan guarantee The 
law does not apply to children's services provided in private residences facilities funded solely by 
Medicare or Medicaid funds, and portions of facilities used for inpatient drug or alcohol treatment Failure 
to comply with the provisions of the law may result in the imposition of a civil monetary penalty of up to 
SI000 per day and/or the imposition of an administrative compliance order on the responsible entity 

The Vendor identified in Section 1.3 of Ihe General Provisions agrees, by signature of the Contractors 
representative as identified in Section 1.11 and 1.12 of the General Provisions to execute the following 
certification 

1 By signing and submitting this contract Ihe Vendor agrees to make reasonable efforts to comply with 
alt applicable provisions of Public Law 103-227 Part C. known as Ihe Pro-Children Act of 1994 


Vendor Name I^Lcrd Youth Alternatives, Inc. 


5 .30-39 
Date 



Name 

Title 


Davit) Dennis 
President 
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BUSINESS ASSOCIATE AGREEMENT 


The Vendor identified in Section 1.3 of the General Provisions of the Agreement agrees to 
comply with the Health Insurance Portability and Accountability Act. Public Law 104-191 and 
with the Standards for Privacy and Security of Individually Identifiable Health Information. 45 
CFR Parts 160 and 164 applicable to business associates As defined herein Business 
Associate' shall mean the Vendor and subcontractors and agents of the Vendor that receive, 
use or have access to protected health information under this Agreement and Covered Entity 
shall mean the State of New Hampshire. Department of Health and Human Services 


(1 Definitions 

a. " Breach" shall have the same meaning as the term Breach" in section 164.402 of Title 45 
Code of Federal Regulations. 

b ' Business Associate" has the meaning given such term in section 160.103 of Title 45, Code 
of Federal Regulations. 

c. Covered Entity" has the meaning given such term in section 160.103 of Title 45. 

Code of Federal Regulations. 

d. Designated Record Set 1 shall have the same meaning as the term "designated record set" 
in 45 CFR Section 164.501. 

e. 1 Data Aggregation ” shall have the same meaning as the lerm data aggregation" in 45 CFR 
Section 164.501. 

f. Heal th C are Operations' shall have the same meaning as the term “health care operations" 
in 45 CFR Section 164.501. 

g. ‘ HITECH Act" means the Health Information Technology for Economic and Clinical Health 
Act, TitleXIII, Subtitle D, Part 1 & 2 of the American Recovery and Reinvestment Act of 
2009. 


h. "HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Public Law 
104-191 and the Standards for Privacy and Security of Individually Identifiable Health 
Information, 45 CFR Parts 160,162 and 164 and amendments thereto. 

i. ' Individual ” shall have the same meaning as the term "individual” in 45 CFR Section 160 103 
and shall include a person who qualifies as a personal representative in accordance with 45 
CFR Section 164.501(g). 

j Privacy Rule ” shall mean the Standards for Privacy of Individually Identifiable Health 
Information at 45 CFR Parts 160 and 164. promulgated under HIPAA by the United States 
Department of Health and Human Services. 


k. “ Protected Health Information ” shall have the same meaning as the term “protected health 
information" in 45 CFR Section 160.103, limited to the information created or receded by 
Business Associate from or on behalf of Covered Entity. 
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I ‘ Required bv Law shall have the same meaning as the term “required by law in 45 CFR 
Section 164.103. 

m Secretary' shall mean the Secretary of the Department of Health and Human Services or 
his/her designee. 

n. Security Rule ' shall mean the Security Standards for the Prolection of Electronic Protected 
Health Information at 45 Cf~R Part 164. Subpart C. and amendments thereto. 

o "Unsecured Protected Health Information 1 means protected health information that is not 
secured by a technology standard that renders protected health information unusable, 
unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by 
a standards developing organization that is accredited by the American National Standards 
Institute. 

p. Other Definitions - All terms not otherwise defined herein shall have the meaning 

established under 45 C.F.R. Parts 160, 162 and 164. as amended from time to lime, and the 

HITECH 

Act 


Business Associate Use and Disclosure of Protected Health Information 


Business Associate shall not use. disclose, maintain or transmit Protected Health 
Information (PHI) except as reasonably necessary to provide the services outlined under 
Exhibit A of the Agreement. Further Business Associate including but not limited to all 
its directors, officers employees and agents, shall not use. disclose, maintain or transmit 
PHI in any manner that would constitute a violation of the Privacy and Security Rule 

Business Associate may use or disclose PHI 

I. For the proper management and administration of the Business Associate. 

II. As required by law. pursuant to the terms set forth in paragraph d. below; or 

III. For data aggregation purposes for the health care operations of Covered 
Entity. 

To the extent Business Associate is permitted under the Agreement to disclose PHI to a 
third party. Business Associate must obtain, prior to making any such disclosure (i) 
reasonable assurances from the third party that such PHI will be held confidentially and 
used or further disclosed only as required by law or for the purpose for which it was 
disclosed to the third party, and (ii) an agreement from such third party to notify Business 
Associate, in accordance with the HIPAA Privacy, Security, and Breach Notification 
Rules of any breaches of the confidentiality of the PHI. to the extent it has obtained 
knowledge of such breach. 

The Business Associate shall not. unless such disclosure is reasonably necessary to 
provide services under Exhibit A of the Agreement disclose any PHI in response to a 
request for disclosure on the basis that it is required by law without first notifying 
Covered Entity so that Covered Entity has an opportunity to object to the disclosure and 
to seek appropriate relief. If Covered Entity objects to such disclosure, the ^usin^ss^ 
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Associate shall refrain from disclosing the PHI until Covered Entity has exhausted all 
remedies. 

e If the Covered Entity notifies the Business Associate that Covered Entity has agreed to 
be bound by additional restrictions over and above those uses or disclosures or security 
safeguards of PHI pursuant to the Privacy and Security Rule the Business Associate 
shall be bound by such additional restrictions and shall not disclose PHI in violation of 
such additional restrictions and shall abide by any additional security safeguards. 



(3) Obligations and Activities of Business Associate . 

a. The Business Associate shall notify the Covered Entity's Privacy Officer immediately 
after the Business Associate becomes aware of any use or disclosure of protected 
health information not provided for by the Agreement including breaches of unsecured 
protected health information and/or any security incident that may have an impact on the 
protected health information of the Covered Entity. 

b. The Business Associate shall immediately perform a risk assessment when it becomes 
aware of any of the above situations. The risk assessment shall include but not be 
fimited to. 

o The nature and extent of the protected health information involved, including the 
types of identifiers and the likelihood of re-identification: 
o The unauthorized person used the protected health information or to whom the 
disclosure was made. 

o Whether the protected health information was actually acquired or viewed 
o The extent to which the risk to the protected health information has been 
mitigated. 

The Business Associate shall complete the risk assessment within 48 hours of the 
breach and immediately report the findings of the risk assessment in writing to the 
Covered Entity. 

c. The Business Associate shall comply with all sections of the Privacy. Security, and 
Breach Notification Rule. 


d. Business Associate shall make available all of its internal policies and procedures, books 
and records relating to the use and disclosure of PHI received from, or created or 
received by the Business Associate on behalf of Covered Entity to the Secretary for 
purposes of determining Covered Entity's compliance with HIPAA and the Privacy and 
Security Rule. 


e. 


3 2014 


Business Associate shall require all of its business associates that receive, use or have 
access to PHI under the Agreement, to agree in writing to adhere lo the same 
restrictions and conditions on the use and disclosure of PHI contained herein, including 
the duty to return or destroy the PHI as provided under Section 3 (I). The Covered Entity 
shall be considered a direct third party beneficiary of the Contractor s business associate 
agreements with Contractor’s intended business associates, who will be receiviqa RHI 
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pursuant to this Agreement, with rights of enforcement and indemnification from such 


business associates who shall be governed by standard Paragraph #13 of the standard 
contract provisions (P-37) of this Agreement for the purpose of use and disclosure of 


protected health information 


f. Within five (5) business days of receipt of a written request from Covered Entity 

Business Associate shall make available during normal business hours at its offices all 
records, books, agreements, policies and procedures relating to the use and disclosure 
of PHI to the Covered Entity, for purposes of enabling Covered Entity to determine 
Business Associate s compliance with the terms of the Agreement. 

g Within ten (10) business days of receiving a written request from Covered Entity. 
Business Associate shall provide access to PHI in a Designated Record Set to the 
Covered Entity, or as directed by Covered Entity, to an individual in order to meet the 
requirements under 45 CFR Section 164.524 


Within ten (10) business days of receiving a written request from Covered Entity for an 
amendment of PHI or a record about an individual contained in a Designated Record 
Set, the Business Associate shall make such PHI available to Covered Entity for 
amendment and incorporate any such amendment to enable Covered Entity to fulfill its 
obligations under 45 CFR Section 164.526. 


Business Associate shall document such disclosures of PHI and information related to 
such disclosures as would be required for Covered Entity to respond to a request by an 
individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 
164.528 


j. Within ten (10) business days of receiving a written request from Covered Entity for a 

request for an accounting of disclosures of PHI, Business Associate shall make available 
to Covered Entity such information as Covered Entity may require to fulfill its obligations 
to provide an accounting of disclosures with respect to PHI in accordance with 45 CFR 
Section 164.528. 


In the event any individual requests access to, amendment of, or accounting of PHI 
directly from the Business Associate, the Business Associate shall within two (2) 
business days forward such request to Covered Entity. Covered Entity shall have the 
responsibility of responding to forwarded requests. However, if forwarding the 
individual's request to Covered Entity would cause Covered Entity or the Business 
Associate to violate HIPAA and the Privacy and Security Rule, the Business Associate 
shall instead respond to the individual's request as required by such law and notify 
Covered Entity of such response as soon as practicable, 


Within ten (10) business days of termination of the Agreement, for any reason, the 
Business Associate shall return or destroy, as specified by Covered Entity, all PHI 
received from, or created or received by the Business Associate in connection with the 
Agreement, and shall not retain any copies or back-up tapes of such PHI, If return or 
destruction is not feasible, or the disposition of the PHI has been otherwise agreed to in 
the Agreement, Business Associate shall continue to extend the protections of the 
Agreement, to such PHI and limit further uses and disclosures of such PHI to those 
purposes that make the return or destruction infeasible, for so long as Business 
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Associate maintains such PHI. ir Covered Entity, in its sole discretion, requires that the 
Business Associate destroy any or all PHI. the Business Associate shall certify to 
Covered Entity that the PHI has been destroyed. 

Obligations of Covered Entity 

Covered Entity shall notify Business Associate of any changes or limitation(s) in its 
Notice of Privacy Practices provided to individuals in accordance with 45 CFR Section 
164 520 to the extent that such change or limitation may affect Business Associate s 
use or disclosure of PHI. 

Covered Entity shall promptly notify Business Associate of any changes in or revocation 
of permission provided to Covered Entity by individuals whose PHI may be used or 
disclosed by Business Associate under this Agreement, pursuant to 45 CFR Section 
164.506 or 45 CFR Section 164.508. 

Covered entity shall promptly notify Business Associate of any restrictions on the use or 
disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR 164.522. 
to the extent that such restriction may affect Business Associate s use or disclosure of 
PHI. 

Termination for Cause 



In addition to Paragraph 10 of the standard terms and conditions (P-37) of this 
Agreement the Covered Entity may immediately terminate the Agreement upon Covered 
Entity's knowledge of a breach by Business Associate of the Business Associate 
Agreement set forth herein as Exhibit I. The Covered Entity may either immediately 
terminate the Agreement or provide an opportunity for Business Associate to cure the 
alleged breach within a timeframe specified by Covered Entity. If Covered Entity 
determines that neither termination nor cure is feasible. Covered Entity shall report the 
violation to the Secretary. 

Miscellaneous 


Definitions and Regulatory References . All terms used, but not otherwise defined herem. 
shall have the same meaning as those terms in the Privacy and Security Rule amended 
from time to time. A reference in the Agreement, as amended to include this Exhibit I to 
a Section in the Privacy and Security Rule means the Section as in effect or as 
amended. 

Amendment . Covered Entity and Business Associate agree to take such action as is 
necessary to amend the Agreement, from time to time as is necessary for Covered 
Entity to comply with the changes in the requirements of HIPAA, the Privacy and 
Security Rule, and applicable federal and state law. 

Data Ownership . The Business Associate acknowledges that it has no ownership rights 
with respect to the PHI provided by or created on behalf of Covered Entity 

Interpretation . The parties agree that any ambiguity in the Agreement shall be resolved 
to permit Covered Entity to comply with HIPAA, the Privacy and Security Rulgrv ^ 
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e. Segregation . If any term or condition of this Exhibit I or the application thereof to any 
person(s) or circumstance is held invalid such invalidity shall not affect other terms or 
conditions which can be given effect without the invalid term or condition, to this end the 
terms and conditions of this Exhibit I are declared severable 

f. Survival . Provisions in this Exhibit I regarding the use and disclosure of PHI. return or 
destruction of PHI extensions of the protections of the Agreement in section (3) I. the 
defense and indemnification provisions of section (3) e and Paragraph 13 of the 
standard terms and conditions (P-37) shall survive the termination of the Agreement. 


IN WITNESS WHEREOF, the parties hereto have duly executed this Exhibit I 


Department of Health and Human Services 

Ixkcrd YotnJj Alternatives. Inc. 

The State 


Signature of Authorized Representative 

Signiture^of Authorized Representative 

David Dennis 

Name of Authorized Representative 

Name of Authorized Representative 

President 

Title of Authorized Representative 

Title of Authorized Representative 

5.mi9 

Date 

Date 




Exhibit I 

Health Insurance Portability Act 
Business Associate Agreement 
Page 6 of & 


Vendor Initials 



Pale 5 30 19 



New Hampshire Department of Health and Human Services 

Exhibit J 



CERTIFICATION REGARDING THE FEDERAL FUNDING ACCOUNTABILITY AND TRANSPARENCY 

ACT fFFATAl COMPLIANCE 

The Federal Funding Accountability and Transparency Act (FFATAj requires prime awardees of individual 
Federal grants equal lo or greater than S25 000 and awarded on or after October 1 2010, to report on 
data related to executive compensation and associated first-tier sub-grants of S25.000 or more. If the 
initial award is below S25.000 but subsequent grant modifications result in a total award equal to or over 
S25 000 the award is subject lo the FFATA reporting requirements, as of the date of the award 
In accordance with 2 CFR Part 170 (Reporting Subaward and Executive Compensation Information) the 
Department of Health and Human Services (DHHS) must report the following information for any 
subaward or contract award subject to the FFATA reporting requirements 

1 Name of entity 

2 Amount of award 

3. Funding agency 

4. NAICS code for contracts / CFDA program number for grants 

5 Program source 

6 Award title descriptive of tire purpose of the funding action 

7 Location of the entity 

6 Principle place of performance 
9 Unique identifier of the entity (DUNS #) 

10. Total compensation and names of the top five executives if 

10.1. More than 80% of annual gross revenues are from the Federal government and those 
revenues are greater lhan S25M annually and 

10.2. Compensation information is not already available through reporting to the SEC 

Prime grant recipients must submit FFATA required data by the end of the month, plus 30 days in which 
the award or award amendment is made. 

The Vendor identified in Section 1 3 of the General Provisions agrees to comply with the provisions of 
The Federal Funding Accountability and Transparency Act. Public Lav/ 109-282 and Public Law 110-252 
and 2 CFR Part 170 (Reporting Subaward and Executive Compensation Information) and further agrees 
to have the Contractors representative, as identified in Sections 1.11 and 1.12 of the General Provisions 
execute the following Certification 

The below named Vendor agrees to provide needed information as outlined above lo the NH Department 
of Health and Human Services and lo comply with all applicable provisions of the Federal Financial 
Accountability and Transparency Act. 


5.30'tQ 

Date 


Vendor Name Ixkcril Youth Alternatives, Inc 



Name 

Title 


David Dennis 
President 
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FORMA 


As the Vendor identified in Section 1 3 of the General Provisions I certify that the responses to Ihe 

below listed questions are true and accurate. 

1 The DUNS number for your entity is 08-068-115S _ 

2 In your business or organization s preceding completed fiscal year, did your business or organization 
receive (1) 80 percent or more of your annual gross revenue in U S federal contracts subcontracts 
loans grants sub-grants and/or cooperative agreements and (2) S25.000 000 or more in annual 
gross revenues from U S. federal contracts, subcontracts, loans grants subgrants and/or 
cooperative agreements'/ 

X NO _YES 

If Ihe answer to #2 above is NO stop here 

If the answer to #2 above is YES please answer Ihe following 

3. Does the public have access to information about the compensation of the executives in your 
business or organization through periodic reports filed under section 13(a) or 15(d) of the Securilies 
Exchange Act of 1934 (15 U.S C 78m(a). 78o(d)) or section 6104 of Ihe Internal Revenue Code of 
1986? 

_NO _YES 

If the answer to #3 above is YES stop here 

If the answer to #3 above is NO please answer the following 

4 The names and compensation of the five most highly compensated officers in your business or 
organization are as follows 


Name 

Amount 

Name 

Amount. 

Name 

Amount 

Name 

Amount 

Name 

Amount 
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A Definitions 


The following terms may be reflected and have the described meaning in this document 

1 “Breach 1 means the loss of control compromise, unauthorized disclosure, 
unauthorized acquisition unauthorized access or any similar term referring to 
situations where persons other than authorized users and for an other than 
authorized purpose have access or potential access to personally identifiable 
information, whether physical or electronic. With regard to Protected Health 
Information. ' Breach 7 shall have the same meaning as the term Breach in section 
164 402 of Title 45 Code of Federal Regulations 

2. Computer Security Incident 1 ' shall have the same meaning Computer Security 
Incident in section two (2) of NIST Publication 800-61. Computer Security Incident 
Handling Guide National Institute of Standards and Technology U S Department 
of Commerce. 

3. Confidential Information or 'Confidential Data' means all confidential information 
disclosed by one party to the other such as all medical, health, financial public 
assistance benefits and personal information including without limitation. Substance 
Abuse Treatment Records, Case Records. Protected Health Information and 
Personally Identifiable Information 

Confidential Information also includes any and all information owned or managed by 
the State of NH - created, received from or on behalf of the Department of Health and 
Human Services (DHHS) or accessed in the course of performing contracted 
services - of which collection, disclosure, protection, and disposition is governed by 
state or federal law or regulation. This information includes but is not limited to 

t Protected Health information (PHI), Personal Information (PI), Personal Financial 
Information (PFI), Federal Tax Information (FTI). Social Security Numbers (SSN) 
Payment Card Industry (PCI) and or other sensitive and confidential information. 

4. End User” means any person or entity (eg., contractor, contractor's employee 
business associate, subcontractor, other downstream user, etc) that receives 
DHHS data or derivative data in accordance with the terms of this Contract 

5. "HIPAA means the Health Insurance Portability and Accountabifity Act of 1996 and the 
regulations promulgated thereunder. 

6. "Incident" means an act that potentially violates an explicit or implied security policy 
which includes attempts (either failed or successful) to gain unauthorized access to a 
system or its data, unwanted disruption or denial of service, the unauthorized use of 
a system for the processing or storage of data, and changes to system hardware 
firmware, or software characteristics without the owner’s knowledge, instruction, or 
consent Incidents include the loss of data through theft or device misplacement, loss 
or misplacement of hardcopy documents, and misrouting of physical or electronic 
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mail, all of which may have the potential to put the data at risk of unauthorized 
access, use. disclosure, modification or destruction. 

7 Open Wireless Network” means any network or segment of a network that is 
not designated by the Stale of New Hampshire’s Department of Information 
Technology or delegate as a protected network (designed, tested, and 
approved, by means of the State, to transmit) will be considered an open 
network and not adequately secure for the transmission of unencrypted PI, PFI. 
PHI or confidential DHHS data. 

8 Personal Information’ (or “PI") means information which can be used to distinguish 
or trace an individual's identity, such as their name, social security number personal 
information as defined in New Hampshire RSA 359-C19. biometric records etc 
alone, or when combined with other personal or identifying information which is linked 
or linkable to a specific individual, such as date and place of birth, mothers maiden 
name etc. 

9. 'Privacy Rule' shall mean the Standards for Privacy of Individually Identifiable Health 
Information at 45 C F.R Parts 160 and 164. promulgated under HIPAA by the United 
Slates Department of Health and Human Services 

10 1 Protected Health Information” (or 'PHI”) has the same meaning as provided in the 
definition of ‘Protected Health Information' in the HIPAA Privacy Rule at 45 C F R. § 
160.103. 

11 “Security Rule shall mean the Security Standards for the Protection of Electronic 
Protected Health Information at 45 C.F R. Part 164, Subpart C. and amendments 
thereto. 

12. “Unsecured Protected Health Information” means Protected Health Information that is 
not secured by a technology standard that renders Protected Health Information 
unusable, unreadable, or indecipherable to unauthorized individuals and is 
developed or endorsed by a standards developing organization that is accredited by 
the American National Standards Institute 

I. RESPONSIBILITIES OF DHHS AND THE CONTRACTOR 
A. Business Use and Disclosure of Confidential Information, 

1 The Contractor must not use. disclose, maintain or transmit Confidential Information 
except as reasonably necessary as outlined under this Contract Further Contractor, 
including but not limited to all its directors officers, employees and agents, must not 
use, disclose, maintain or transmit PHI in any manner that would constitute a violation 
of the Privacy and Security Rule. 

2. The Contractor must not disclose any Confidential Information in response to a 
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request for disclosure on the basis that it is required by law in response to a 
subpoena, etc without first notifying DHHS so that DHHS has an opportunity to 
consent or object to the disclosure 

3 If DHHS notifies the Contractor that DHHS has agreed to be bound by additional 
restrictions over and above those uses or disclosures or security safeguards of PHI 
pursuant to the Privacy and Security Rule, the Contractor must be bound by such 
additional restrictions and must not disclose PHI in violation of such additional 
restrictions and must abide by any additional security safeguards 

4 The Contractor agrees that DHHS Data or derivative there from disclosed to an End 
User must only be used pursuant to the tenns of this Contract 

5. The Contractor agrees DHHS Data obtained under this Contract may not be used for 
any other purposes that are not indicated in this Contract 

6. The Contractor agrees to grant access to the data to the authorized representatives 
of DHHS for the purpose of inspecting to confirm compliance with the terms of this 
Contract. 

II. METHODS OF SECURE TRANSMISSION OF DATA 

1 Application Encryption, If End User is transmitting DHHS data containing 
Confidential Data between applications, the Contractor attests the applications have 
been evaluated by an expert knowledgeable in cyber security and that said 
application’s encryption capabilities ensure secure transmission via the internet. 

2. Computer Disks and Portable Storage Devices. End User may not use computer disks 
or portable storage devices, such as a thumb drive as a method of transmitting DHHS 
data. 

3 Encrypted Email. End User may only employ email to transmit Confidential Data if 
email is encrypted and being sent to and being received by email addresses of 
persons authorized to receive such information. 

4 Encrypted Web Site. If End User is employing the Web to transmit Confidential 
Data, the secure socket layers (SSL) must be used and the web site must be 
secure SSL encrypts data transmitted via a Web site. 

5 File Hosting Services, also known as File Sharing Sites. End User may not use file 
hosting services, such as Dropbox or Google Cloud Storage, to transmit 
Confidential Data. 

6 Ground Mail Service End User may only transmit Confidential Data via certified ground 
mail within the continental U.S. and when sent to a named individual. 

7 Laptops and PDA. If End User is employing portable devices to transmit 
Confidential Data said devices must be encrypted and password protected. 

8 Open Wireless Networks. End User may not transmit Confidential Data via an open 
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wireless network. End User must employ a virtual private network (VPN) when 
remotely transmitting via an open wireless network. 

9 Remote User Communication. If End User is employing remote communication to 
access or transmit Confidential Data, a virtual private network (VPN) must be 
installed on the End User s mobile device(s) or laptop from which information will be 
transmitted or accessed. 

10 SSH File Transfer Protocol (SFTP), also known as Secure File Transfer Protocol. If 
End User is employing an SFTP to transmit Confidential Data. End User will 
structure the Folder and access privileges to prevent inappropriate disclosure of 
information. SFTP folders and sub-folders used for transmitting Confidential Data will 
be coded for 24-hour auto-deletion cycle (i e Confidential Data will be deleted every 24 
hours) 

11 Wireless Devices If End User is transmitting Confidential Data via wireless devices all 
data must be encrypted to prevent inappropriate disclosure of information 

III. RETENTION AND DISPOSITION OF IDENTIFIABLE RECORDS 

The Contractor will only retain the data and any derivative of the data for the duration of this 
Contract After such time, the Contractor will have 30 days to destroy the data and any 
derivative in whatever form it may exist, unless otherwise required by law or permitted 
under this Contract To this end. the parties must. 

A Retention 

1 The Contractor agrees it will not store, transfer or process data collected in 
connection with the services rendered under this Contract outside of the United 
States. This physical location requirement shall also apply in the implementation of 
cloud computing, cloud service or cloud storage capabilities, and includes backup 
data and Disaster Recovery locations 

2. The Contractor agrees to ensure proper security monitoring capabilities are in 
place to delect potential security events that can impact State of NH systems 
and/or Department confidential information for contractor provided systems. 

3. The Contractor agrees to provide security awareness and education for its End 
Users in support of protecting Department confidential information. 

4 The Contractor agrees to retain ali electronic and hard copies of Confidential Data 
in a secure location and identified in section IV A.2 

5. The Contractor agrees Confidential Data stored in a Cloud must be in a 
FedRAMP/HITECH compliant solution and comply with all applicable statutes and 
regulations regarding the privacy and security. All servers and devices must have 
currently-supported and hardened operating systems, the latest anti-viral, anti- 
hacker, anti-spam anti-spyware, and anti-malware utilities. The environment, as a 
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whole, must have aggressive intrusion-detection and firewall protection 

6. The Contractor agrees to and ensures its complete cooperation with the State s 
Chief Information Officer in the detection of any security vulnerability of the hosting 
infrastructure 


B Disposition 

1 If the Contractor will maintain any Confidential Information on its systems (or its 
sub-contractor systems), the Contractor will maintain a documented process for 
securely disposing of such data upon request or contract termination and will 
obtain written certification for any State of New Hampshire data destroyed by the 
Contractor or any subcontractors as a part of ongoing emergency and or disaster 
recovery operations When no longer in use. electronic media containing State of 
New Hampshire data shall be rendered unrecoverable via a secure wipe program 
in accordance with industry-accepted standards for secure deletion and media 
sanitization, or otherwise physically destroying the media {for example, 
degaussing) as described in NIST Special Publication 800-88. Rev 1. Guidelines 
for Media Sanitization, National Institute of Standards and Technology. U S 
Department of Commerce The Contractor will document and certify in writing at 
time of the data destruction, and will provide written certification to the Department 
upon request. The written certification will include all details necessary to 
demonstrate data has been properly destroyed and validated. Where applicable, 
regulatory and professional standards for retention requirements will be jointly 
evaluated by the State and Contractor prior to destruction 

2 Unless otherwise specified, within thirty (30) days of the termination of this 
Contract, Contractor agrees to destroy all hard copies of Confidential Data using a 
secure method such as shredding 

3. Unless otherwise specified, within thirty (30) days of the termination of this 
Contract, Contractor agrees to completely destroy all electronic Confidential Data 
by means of data erasure, also known as secure data wiping. 

IV, PROCEDURES FOR SECURITY 

A. Contractor agrees to safeguard the DHHS Data received under this Contract, and any 
derivative data or files, as follows: 

1. The Contractor will maintain proper security controls to protect Department 
confidential information collected, processed, managed, and/or stored in the delivery 
of contracted services. 


2. The Contractor will maintain policifes and procedures to protect Department 
confidential information throughout the information lifecycle, where applicable (from 
creation, transformation, use, storage and secure destruction) regardless of the 
media used to store the data (i.e., tape, disk, paper, etc.) 
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3 The Contractor will maintain appropriate authentication and access controls to 
contractor systems that collect, transmit, or store Department confidential information 
where applicable 

4. The Contractor will ensure proper security monitoring capabilities are in place to 
delect potential security events that can impact Stale of NH systems and/or 
Department confidential information for contractor provided systems 

5 The Contractor will provide regular security awareness and education for its End 
Users in support of protecting Department confidential information 

6 If the Contractor will be sub-contracting any core functions of the engagement 
supporting the services for State of New Hampshire the Contractor will maintain a 
program of an internal process or processes that defines specific security 
expectations and monitoring compliance to security requirements that at a minimum 
match those for the Contractor including breach notification requirements. 

7 The Contractor will work with the Department to sign and comply with all applicable 
Stale of New Hampshire and Department system access and authorization policies 
and procedures, systems access forms, and computer use agreements as part of 
obtaining and maintaining access to any Department system(s) Agreements will be 
completed and signed by the Contractor and any applicable sub-contractors prior to 
system access being authorized. 

8 If the Department determines the Contractor is a Business Associate pursuant to 45 
CFR 160 103, the Contractor will execute a HIPAA Business Associate Agreement 
(BAA) with the Department and is responsible for maintaining compliance with the 
agreement. 

9. The Contractor will work with the Department at its request to complete a System 
Management Survey. The purpose of the survey is to enable the Department and 
Contractor to monitor for any changes in risks, threats, and vulnerabilities that may 
occur over the life of the Contractor engagement. The survey will be completed 
annually, or an alternate time frame at the Departments discretion with agreement by 
the Contractor, or the Department may request the survey be completed when the 
scope of the engagement between the Department and the Contractor changes 

10. The Contractor will not store, knowingly or unknowingly, any State of New Hampshire 
or Department data offshore or outside the boundaries of the United States unless 
prior express written consent is obtained from the Information Security Office 
leadership member within the Department 

11 Data Security Breach Liability In the event of any security breach Contractor shall 
make efforts to investigate the causes of the breach promptly take measures to 
prevent future breach and minimize any damage or loss resulting from the breach 
The State shall recover from the Contractor all costs of response and recovery from 
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the breach, including but not limited to credit monitoring services, mailing costs and 
costs associated with website and telephone call center services necessary due to 
the breach. 

12 Contractor must, comply with all applicable statutes and regulations regarding the 
privacy and security of Confidential Information, and must in all other respects 
maintain the privacy and security of PI and PHI at a level and scope that is not less 
than the level and scope of requirements applicable to federal agencies including 
but not limited to, provisions of the Privacy Act of 1974 (5 U.S.C § 552a), DHHS 
Privacy Act Regulations {45 C.F.R. §5b). HIPAA Privacy and Security Rules (45 
C.F.R. Parts 160 and 164) that govern protections for individually identifiable health 
information and as applicable under Stale law 

13. Contractor agrees to establish and maintain appropriate administrative, technical, and 
physical safeguards to protect the confidentiality of the Confidential Data and to 
prevent unauthorized use or access to it. The safeguards must provide a level and 
scope of security that is not less than the level and scope of security requirements 
established by the State of New Hampshire, Department of Information Technology. 
Refer to Vendor Resources/Procurement at https.//www. nh.gov/doit/vendor/index.htm 
for the Department of Information Technology policies guidelines, standards, and 
procurement information relating to vendors. 

14 Contractor agrees to maintain a documented breach notification and incident 
response process The Contractor will notify the Stale s Privacy Officer and the 
State’s Security Officer of any security breach immediately, at the email addresses 
provided in Section VI. This includes a confidential information breach, computer 
security incident, or suspected breach which affects or includes any State of New 
Hampshire systems that connect to the State of New Hampshire network 

15. Contractor must restrict access 1o the Confidential Data obtained under this 
Contract to only those authorized End Users who need such DHHS Data to 
perform their official duties in connection with purposes identified in this Contract. 

16. The Contractor must ensure that all End Users 

a comply with such safeguards as referenced in Section IV A. above, 
implemented to protect Confidential Information that is furnished by DHHS 
under this Contract from loss, theft or inadvertent disclosure. 

b. safeguard this information at all times 

c. ensure that laptops and other electronic devices/media containing PHI. PI. or 
PFI are encrypted and password-protected. 

d. send emails containing Confidential Information only if encrypted and being 
sent to and being received by email addresses of persons authorized to 
receive such information. 
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e. limit disclosure of the Confidential Information to the extent permitted by law 

f Confidential Information received under this Contract and individually 
identifiable data derived from DHHS Data, must be stored in an area that is 
physically and technologically secure from access by unauthorized persons 
during duty hours as well as non-duty hours (e g door locks card keys, 
biometric identifiers, etc) 

g only authorized End Users may transmit the Confidential Data including any 
derivative files containing personally identifiable information, and in all cases 
such data must be encrypted at all times when in transit, at rest, or when 
stored on portable media as required in section IV above. 

h. in all other instances Confidential Data must be maintained, used and 
disclosed using appropriate safeguards, as determined by a risk based 
assessment of the circumstances involved. 

i. understand that their user credentials (user name and password) must not be 
shared with anyone End Users will keep their credential information secure 
This applies to credentials used to access the site directly or indirectly through 
a third party application. 


Contractor is responsible for oversight and compliance of their End Users DHHS 
reserves the right to conduct onsite inspections to monitor compliance with this 
Contract, including the privacy and security requirements provided in herein. HIPAA. 
and other applicable laws and Federal regulations until such time the Confidential Data 
Is disposed of in accordance with this Contract. 

V. LOSS REPORTING 

The Contractor must notify the States Privacy Officer and Security Officer of any 
Security Incidents and Breaches immediately, at the email addresses provided in 
Section VI 

The Contractor must further handle and report Incidents and Breaches involving PHI in 
accordance with the agency s documented Incident Handling and Breach Notification 
procedures and in accordance with 42 CFR §§ 431.300 - 306 In addition to, and 
notwithstanding, Contractor s compliance with all applicable obligations and procedures 
Contractor’s procedures must also address how the Contractor will: 

1 Identify Incidents; 

2 Determine if personally identifiable information is involved in Incidents, 

3. Report suspected or confirmed Incidents as required in this Exhibit or P-37 

4 Identify and convene a core response group to determine the risk level of Incidents 
and determine risk-based responses to Incidents: and 
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5 Determine whether Breach notification is required and. if so identify appropriate 
Breach notification methods liming, source, and contents from among different 
options and bear costs associated with the Breach notice as well as any mitigation 
measures 

Incidents and/or Breaches that implicate PI must be addressed and reported, as 
applicable, in accordance with NH RSA 359-C 20 

VI. PERSONS TO CONTACT 
A. DHHS Privacy Officer 

DHHSPrivacyOfficer@dhhs nh.gov 
B DHHS Security Officer 

DHHSInformalionSecuntyOffice@dhhs nh gov 
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